Standard contractual clauses: what EU SCCs and UK SCCs are
Standard contractual clauses (SCCs) are model data protection terms, pre-approved by the European Commission, that a company signs with a recipient outside the EU so it can lawfully send personal data there under the GDPR. The current EU set dates from June 4, 2021 (Implementing Decision 2021/914). The UK uses its own International Data Transfer Agreement (IDTA) or a UK Addendum to the EU clauses, in force since March 21, 2022.
Standard contractual clauses (SCCs) are contract terms adopted by the European Commission that data exporters and importers sign to provide GDPR safeguards when personal data is transferred to a country outside the EU.
On this page
What SCCs do in practice
Any time personal data about people in the EU goes to a country without an EU adequacy decision, the exporter needs a transfer tool. SCCs are the most common one. For an employer, typical transfers are payroll and HR records sent to a US parent company, an employer of record platform, or an HR system hosted abroad.
The 2021 clauses replaced the three older sets adopted under the 1995 Data Protection Directive. They are built in modules for different relationships: controller to controller, controller to processor, processor to processor and processor to controller. The Commission publishes a Q&A on using them (latest version dated May 25, 2022) and says it is developing more sets for importers whose processing is already directly subject to the GDPR.
EU SCCs vs UK SCCs
| Data leaving | Tool | In force |
|---|---|---|
| EU or EEA | EU SCCs (Implementing Decision 2021/914) | Adopted June 4, 2021 |
| United Kingdom | IDTA, or the UK Addendum to the EU SCCs | March 21, 2022 (laid before Parliament February 2, 2022) |
Sources: European Commission SCC page and UK ICO IDTA guidance, checked Oct 18, 2026.
"UK SCC" in searches usually means one of these two UK tools. A company with staff in both the EU and the UK can sign the EU SCCs with the UK Addendum attached, rather than two separate agreements. See the UK employment page for the payroll side.
An example: an EOR team in Spain, Germany and the UK
You hire two people in Spain, one in Germany and one in the UK through an EOR with a US platform. Before the first payroll, check that the EOR's data processing terms include:
- the EU SCCs in the right module for the Spanish and German employees' data;
- the UK Addendum or IDTA for the UK employee's data;
- a list of subprocessors and the countries they sit in;
- a transfer impact assessment for the US and each subprocessor country.
Four employees, two legal regimes, one contract package. Costs for the hires themselves are on the Spain EOR page and the Germany EOR page.
SCCs vs other transfer terms
- Data processing agreement (DPA): the general contract with a processor; SCCs are often attached to it.
- Transfer impact assessment: the check that SCCs can work in the destination country.
- Binding corporate rules: approved internal rules for transfers inside one corporate group.
When choosing a provider, ask for these documents during the sales process. Compare providers in the best EOR providers and global payroll options.
Frequently asked questions
What are EU SCCs?
What is the UK SCC?
Are standard contract clauses the same as SCCs?
Do I need SCCs if I hire through an EOR?
Do SCCs need a transfer impact assessment?
Sources (2)
- European Commission: Standard contractual clauses (SCC) (checked Oct 18, 2026)
- Information Commissioner’s Office (UK): International data transfer agreement and guidance (checked Oct 18, 2026)
This page is general information, not tax, legal or accounting advice. Rules and rates change, so check the official source linked above before you file or sign a contract. Read our disclaimer.