Standard contractual clauses: what EU SCCs and UK SCCs are

Standard contractual clauses (SCCs) are model data protection terms, pre-approved by the European Commission, that a company signs with a recipient outside the EU so it can lawfully send personal data there under the GDPR. The current EU set dates from June 4, 2021 (Implementing Decision 2021/914). The UK uses its own International Data Transfer Agreement (IDTA) or a UK Addendum to the EU clauses, in force since March 21, 2022.

Standard contractual clauses (SCCs) are contract terms adopted by the European Commission that data exporters and importers sign to provide GDPR safeguards when personal data is transferred to a country outside the EU.

On this page

What SCCs do in practice

Any time personal data about people in the EU goes to a country without an EU adequacy decision, the exporter needs a transfer tool. SCCs are the most common one. For an employer, typical transfers are payroll and HR records sent to a US parent company, an employer of record platform, or an HR system hosted abroad.

The 2021 clauses replaced the three older sets adopted under the 1995 Data Protection Directive. They are built in modules for different relationships: controller to controller, controller to processor, processor to processor and processor to controller. The Commission publishes a Q&A on using them (latest version dated May 25, 2022) and says it is developing more sets for importers whose processing is already directly subject to the GDPR.

EU SCCs vs UK SCCs

Transfer tools for employee data
Data leavingToolIn force
EU or EEAEU SCCs (Implementing Decision 2021/914)Adopted June 4, 2021
United KingdomIDTA, or the UK Addendum to the EU SCCsMarch 21, 2022 (laid before Parliament February 2, 2022)

Sources: European Commission SCC page and UK ICO IDTA guidance, checked Oct 18, 2026.

"UK SCC" in searches usually means one of these two UK tools. A company with staff in both the EU and the UK can sign the EU SCCs with the UK Addendum attached, rather than two separate agreements. See the UK employment page for the payroll side.

An example: an EOR team in Spain, Germany and the UK

You hire two people in Spain, one in Germany and one in the UK through an EOR with a US platform. Before the first payroll, check that the EOR's data processing terms include:

  • the EU SCCs in the right module for the Spanish and German employees' data;
  • the UK Addendum or IDTA for the UK employee's data;
  • a list of subprocessors and the countries they sit in;
  • a transfer impact assessment for the US and each subprocessor country.

Four employees, two legal regimes, one contract package. Costs for the hires themselves are on the Spain EOR page and the Germany EOR page.

SCCs vs other transfer terms

  • Data processing agreement (DPA): the general contract with a processor; SCCs are often attached to it.
  • Transfer impact assessment: the check that SCCs can work in the destination country.
  • Binding corporate rules: approved internal rules for transfers inside one corporate group.

When choosing a provider, ask for these documents during the sales process. Compare providers in the best EOR providers and global payroll options.

Frequently asked questions

What are EU SCCs?
EU SCCs are standard contractual clauses adopted by the European Commission that let companies transfer personal data outside the EU with GDPR safeguards. The current set was adopted on June 4, 2021 in Implementing Decision 2021/914.
What is the UK SCC?
The UK uses the International Data Transfer Agreement (IDTA) or the UK Addendum to the EU SCCs. Both came into force on March 21, 2022, according to the UK ICO.
Are standard contract clauses the same as SCCs?
Yes. Standard contract clauses, standard contractual clauses and model clauses all refer to the same pre-approved data transfer terms.
Do I need SCCs if I hire through an EOR?
If employee data about people in the EU or UK is sent to or accessed from a country without an adequacy decision, such as through a US-hosted platform, a transfer tool like SCCs is needed. Ask the EOR which clauses its contract includes.
Do SCCs need a transfer impact assessment?
Since the Schrems II judgment, exporters using SCCs are expected to assess whether the destination country's law lets the importer comply. The UK ICO calls this a transfer risk assessment.
Sources (2)
  1. European Commission: Standard contractual clauses (SCC) (checked Oct 18, 2026)
  2. Information Commissioner’s Office (UK): International data transfer agreement and guidance (checked Oct 18, 2026)

This page is general information, not tax, legal or accounting advice. Rules and rates change, so check the official source linked above before you file or sign a contract. Read our disclaimer.