Standard Contractual Clauses (SCCs)
Definition
Pre-approved contract terms issued by the European Commission that create GDPR-compliant safeguards for cross-border data transfers to countries without an adequacy decision. Widely used for forensic data-sharing arrangements.
- Issued by
- European Commission
- Purpose
- GDPR-compliant safeguard for cross-border data transfers
- Applies to
- Transfers to countries without an adequacy decision
- Forensic use
- Cross-border forensic data-sharing agreements
Common questions
When does a forensic laboratory need SCCs for a data transfer?+
When personal data covered by GDPR, such as DNA profiles or case files, moves to a laboratory or partner in a country the European Commission has not granted an adequacy decision to, SCCs provide the contractual basis that makes the transfer lawful.
Do SCCs replace the need for other data protection measures?+
No. They are a contractual safeguard, not a substitute for technical measures like encryption or for assessing whether the destination country's laws could still allow government access to the transferred data, which the Schrems II ruling requires transferring parties to evaluate.
Related terms
- Aadhaar Exclusion (DPDP Act S.17(2))
- Provision that exempts processing covered by the Aadhaar Act 2016 from the general DPDP Act regime, meaning UIDAI biometric data is governed...
- Adequate Country (GDPR Ch. V)
- A country that the European Commission has determined provides a level of data protection essentially equivalent to the EU's. As of mid-2026,...
- Biometric Identifier (BIPA)
- Under Illinois BIPA: a retina or iris scan, fingerprint, voiceprint, or scan of a person's hand or face geometry; distinct from 'biometric...
- Data Fiduciary (DPDP Act)
- Any person who alone or in conjunction with others determines the purpose and means of processing personal data; the DPDP Act equivalent...
- Data Protection Impact Assessment (DPIA)
- A structured risk assessment required under Article 35 before any processing that is likely to result in high risk to individuals' rights...
- Explicit Consent (GDPR)
- A higher consent standard required for special-category data processing under Article 9(2)(a): must be freely given, specific, informed, and involve an explicit...
- Per-Violation Damages (BIPA)
- BIPA's statutory damages structure: USD 1,000 per negligent violation or USD 5,000 per intentional/reckless violation; confirmed by Cothron v. White Castle (2023)...
- Real-Time Remote Biometric Identification (RTBI)
- As defined in the EU AI Act: automated identification of natural persons at a distance by comparing their biometric data to those...
- Special-Category Data (GDPR)
- Personal data revealing racial or ethnic origin, political opinions, religious beliefs, trade-union membership, genetic data, biometric data for unique identification, health data,...