What is an SCC Controller Agreement?

An SCC Controller Agreement implements the EU Standard Contractual Clauses for controller-to-controller transfers, documenting parties, data categories, purposes, and safeguards to meet GDPR transfer requirements.

Can this agreement be signed electronically?

Yes. Electronic signatures are generally enforceable under ESIGN and UETA in the United States when intent, consent, attribution, and retention are demonstrable and any sectoral rules are observed.

Do I need notarization or witnesses?

Not typically for data-transfer agreements; notarization is not a standard GDPR requirement. Follow state-specific formalities only if a local statute or counterparty requests notarization.

How quickly must breaches be reported?

Contract should require prompt notification to enable regulatory timelines; many regimes expect rapid notification of significant breaches to counterparties and authorities.

Who should sign the agreement?

An authorized officer or representative with authority to bind the entity; ensure the signature block states the signer's title and capacity to avoid enforceability questions.

How do I amend or revoke the agreement?

Use a written amendment executed by authorized signatories. Revocation should be handled per termination clauses with agreed transition and data return or deletion procedures.

Electronic Signature
Templates
Legal
SCC Controller Agreement

SCC Controller Agreement

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

SCC Controller Agreement

This Controller Agreement (the "Agreement") is entered into effective as of Day: Month: Year: (the "Effective Date"), by and between Party A: , principal place of business at ; and Party B: , principal place of business at .

RECITALS

WHEREAS, each Party determines the purposes and means of the Processing of certain Personal Data and therefore acts as a Controller with respect to such Personal Data;

WHEREAS, the Parties wish to set out their respective responsibilities for compliance with applicable data protection laws, to allocate obligations relating to Data Subject requests, security, breach notification and international transfers where applicable;

WHEREAS, the Parties agree that their arrangement regarding jointly or independently determined purposes and means is governed by this Agreement.

NOW, THEREFORE, in consideration of the mutual covenants herein, the Parties agree as follows:

1. DEFINITIONS

1.1. "Personal Data" means any information relating to an identified or identifiable natural person processed by or on behalf of either Party under this Agreement.

1.2. "Processing" has the meaning given in applicable data protection law and includes any operation performed upon Personal Data.

1.3. Other capitalized terms used in this Agreement shall have the meanings ascribed to them in applicable data protection legislation unless otherwise defined herein.

2. SCOPE AND PURPOSE

2.1. Each Party shall act as Controller with respect to Personal Data that it collects or receives and for which it determines the purposes and means of Processing.

2.2. The Parties shall each process Personal Data only for the following purposes:

3. DETERMINATION OF ROLES

3.1. The Parties acknowledge and agree that for the Personal Data described in Section 2, they are: Joint Data Controllers Independent Data Controllers (select the applicable box; selection allocates responsibilities as set forth below).

4. ALLOCATION OF RESPONSIBILITIES

4.1. Where the Parties are Joint Data Controllers, they shall jointly determine and document their respective responsibilities to Data Subjects and supervisory authorities by reference to this Agreement. Each Party shall:

(a) ensure lawful grounds for its Processing of Personal Data;

(b) implement appropriate technical and organisational measures described in Section 6;

(c) respond to Data Subject requests regarding the Personal Data it controls in accordance with applicable law and cooperate with the other Party where requests concern both Parties' processing; and

(d) provide the other Party with timely information necessary to fulfil legal obligations to Data Subjects and regulators.

5. DATA SUBJECT RIGHTS

5.1. Each Party shall promptly notify the other Party upon receipt of a Data Subject request that relates to Personal Data processed under this Agreement. The Parties shall coordinate their responses in good faith and allocate responsibility for responding as follows:

5.2. Where a request relates exclusively to the Personal Data controlled by one Party, that Party shall be responsible for responding. Where a request relates to Personal Data controlled by both Parties, the Parties shall cooperate and provide a joint response where reasonably practicable.

6. SECURITY AND CONFIDENTIALITY

6.1. Each Party shall implement and maintain appropriate technical and organisational measures to protect Personal Data against unauthorized or unlawful processing and against accidental loss, destruction or damage. Such measures shall be proportionate to the risk and shall include, where appropriate, access controls, encryption, and audit logging.

6.2. Each Party shall ensure that any person authorized to process Personal Data on its behalf is subject to confidentiality obligations and only processes Personal Data in accordance with this Agreement.

7. INCIDENTS AND BREACH NOTIFICATION

7.1. Each Party shall notify the other without undue delay upon becoming aware of a Personal Data Breach affecting Personal Data processed under this Agreement, providing a description of the nature of the breach, categories of Personal Data affected, likely consequences and measures taken in response.

7.2. Parties shall cooperate to notify relevant supervisory authorities and Data Subjects when required by applicable law and to take reasonable remedial steps to mitigate adverse effects.

8. INTERNATIONAL TRANSFERS

8.1. Where any Party transfers Personal Data to a jurisdiction outside the territory in which it was collected, that Party shall ensure that such transfer is lawful under applicable data protection law and that appropriate safeguards are in place to protect the Personal Data.

9. LIABILITY AND INDEMNIFICATION

9.1. Each Party shall be liable for its own acts and omissions in relation to the Processing of Personal Data and shall indemnify the other Party for losses arising from its breach of this Agreement or violation of applicable data protection law, except to the extent such loss is caused by the other Party's breach.

10. RETURN OR DELETION

10.1. Upon termination of this Agreement or upon request where required by law, each Party shall, at its option, return or securely delete Personal Data that it controls, unless retention is required by applicable law. Each Party shall certify in writing to the other the return or deletion upon request.

11. NOTICES

Party A Data Protection Contact Party A Contact Address for Notices Party B Data Protection Contact Party B Contact Address for Notices

Notices under this Agreement shall be in writing and delivered to the contact details set forth above or as otherwise notified in writing. Notices are effective upon receipt.

12. AMENDMENT AND WAIVER

12.1. No amendment or waiver of any provision of this Agreement shall be effective unless in writing and signed by authorized representatives of both Parties.

13. GOVERNING LAW; ENTIRE AGREEMENT; SEVERABILITY; COUNTERPARTS

13.1. Governing Law. This Agreement shall be governed by and construed in accordance with the law specified by the Parties:

13.2. Entire Agreement. This Agreement constitutes the entire agreement between the Parties relating to its subject matter and supersedes all prior agreements and understandings between the Parties relating to such subject matter.

13.3. Severability. If any provision of this Agreement is held to be invalid or unenforceable, the remaining provisions shall remain in full force and effect.

13.4. Counterparts. This Agreement may be executed in counterparts, each of which shall be deemed an original and all of which together shall constitute one and the same instrument.

14. MISCELLANEOUS PROVISIONS

14.1. Remedies. The Parties acknowledge that a breach of this Agreement may cause irreparable harm for which damages would be an inadequate remedy and that equitable relief may be sought in addition to other remedies.

14.2. No Third-Party Beneficiaries. Except as explicitly set forth in this Agreement, nothing herein is intended to confer rights on any third party.

Party A:

By:

Date:

Party B:

By:

Date:

What the SCC Controller Agreement Is and When it Applies

A SCC Controller Agreement is a written contract that implements the EU Standard Contractual Clauses for controller-to-controller cross-border personal data transfers and documents the parties' responsibilities. It is used where two data controllers transfer or share EU personal data and need a legal mechanism that complements GDPR obligations, data-mapping, and appropriate safeguards. In U.S. contexts the agreement often sits alongside organizational policies, data processing addenda, and any U.S. compliance requirements such as HIPAA or state privacy laws to ensure consistent handling and breach response procedures.

Why organizations adopt an SCC Controller Agreement

The SCC Controller Agreement sets clear legal responsibilities for each controller, documents lawful bases for transfers, and demonstrates technical and organizational measures. It reduces legal uncertainty for cross-border transfers and supports compliance programs, incident response, and downstream contractual liability allocation.

Typical users and teams that prepare the SCC Controller Agreement

Several internal and external stakeholders commonly prepare or review this agreement before cross-border data sharing.

Data Protection Officers and Privacy Teams responsible for GDPR mapping and transfer risk assessments.
Legal and Contracts teams drafting allocation of liability, warranties, and audit rights between controllers.
Business owners and vendor managers negotiating operational details, data categories, and retention periods.

Close coordination among privacy, legal, and IT teams ensures the agreement matches operational reality and regulatory expectations.

Core components to include in a professional SCC Controller Agreement

A comprehensive SCC Controller Agreement combines the prescribed SCC language with tailored operational clauses, security descriptions, and breach procedures so the contract is both legally effective and practically enforceable across jurisdictions.

SCC Module

Include the controller-to-controller SCC text exactly where required, and link it to the parties, data categories, and the transfer mechanism so the clause triggers correctly under GDPR transfer rules.

Scope & Purpose

Define data categories, subject categories, retention limits, and the business purpose for processing to limit ambiguity and to support lawful basis documentation under GDPR.

Security Measures

Describe technical and organizational measures in concrete terms (encryption, access controls, logging, vulnerability management) and reference where additional security details are held.

Liability & Indemnity

Allocate responsibilities for breaches, regulatory fines, and third-party claims with clear indemnity clauses and limitation-of-liability provisions that align with commercial risk tolerance.

Breach Notification

State notification timelines, point-of-contact details, required content for notices, and coordination obligations for regulatory filings and affected data subjects.

Audit & Subprocessor

Define audit rights, frequency, and subprocessor approval or notice processes so controllers can verify compliance across the transfer chain.

Required information and key fields

Party Names: Legal entity names

Contact Details: DPO or privacy contact

Data Types: Categories of personal data

Purposes: Processing purpose

Retention: Retention period

Applicable Law: Governing law

Step-by-step: completing an SCC Controller Agreement

Follow these sequential steps to prepare, review, and finalize the agreement with minimal rework and clear audit evidence.

01

Map the transfer: Identify data items, export locations, and legal bases.
02

Select SCC module: Confirm controller-to-controller module matches the transfer type.
03

Tailor operational clauses: Add security, breach, retention, and subprocessor terms.
04

Sign and archive: Obtain signatures, save executed copy, and record audit metadata.

How to customize the agreement for online completion

Configure your digital workflow to match signing order, authentication level, and optional conditional fields before sending for signatures.

Field	Configuration
Signature Type	Electronic signature with audit trail
Authentication	Email link or SMS code for signer verification
Conditional Fields	Show additional clauses when data categories include sensitive data
Archive Location	Store executed copy in encrypted repository

Where to send, file, and store the signed agreement

A predictable routing and storage plan ensures enforceability and supports audits and breach investigations.

Primary Filing: Store executed PDF in company contract repository.
Operational Copies: Provide security and privacy teams read access for compliance checks.
Regulatory Reporting: Retain contact details and breach records for regulator queries.
Third Parties: Attach executed agreement to vendor files and change logs.

Digital signing and distribution options

Choose a platform that supports secure signatures, audit trails, and HIPAA or 21 CFR Part 11 controls when required.

File formats: PDF and Word DOCX supported
Integrations: Salesforce, NetSuite, Google Workspace
Authentication: Email, SMS, or advanced auth

Ensure your chosen solution captures timestamps, signer attribution, and a tamper-evident audit trail for compliance records.

Timelines, deadlines, and processing expectations

Key timing rules govern notification, signature turnaround, and retention; set internal SLAs to meet regulatory and contractual obligations.

Signature Turnaround:

Target 7–14 days for negotiation and signature.

Breach Notification:

Notify counterparties promptly; GDPR-style regulator notice may expect expedited timing.

Retention Start:

Begins on the effective date unless otherwise specified.

Audit Frequency:

Plan annual or risk-based audits of transfer controls.

Contract Renewal:

Review and re-sign SCC terms at renewals or material scope changes.

Common mistakes when preparing an SCC Controller Agreement

Copying template SCC text without adapting parties, data categories, or technical measures leads to gaps and regulator questions.
Failing to document lawful bases and data mapping increases the risk of noncompliance and fines if transfers are challenged.
Leaving retention and deletion mechanics vague results in inconsistent practices and poor defensibility during audits.
Not aligning operational controls with contractual promises creates exposure when a downstream processor or subprocess fails to comply.

Penalties and risks of an incorrect or incomplete agreement

Regulatory Fines: Potential large fines

Contract Liability: Damages or indemnity obligations

Business Disruption: Suspension of transfers

Reputational Harm: Loss of customer trust

Enforceability Issues: Ambiguous terms may be unenforceable

Audit Findings: Mandatory remediation costs

Real-world examples of SCC Controller Agreement use

Two practical examples show how organizations adapt SCC Controller Agreements to different operational needs.

Cross-border Vendor Data Share

A U.S. marketing firm transfers EU contact lists to a European analytics provider.

The parties append controller-to-controller SCCs and map categories.
The executed agreement clarified retention, audit rights, and breach notification to meet both GDPR obligations and U.S. client expectations.

International Collaboration

A U.S. university shares research participant data with a Swiss partner.

They use SCC language to document controller responsibilities and research purpose limits.
The agreement added narrow access rules and a specified retention trigger tied to project close and publication dates.

How to update or revise an existing SCC Controller Agreement

Use a controlled amendment process to log changes, obtain approvals, and preserve a clear execution trail for audits and regulators.

01

Identify Change:

Document scope and reason for revision.

02

Assess Impact:

Evaluate privacy, security, and legal consequences.

03

Draft Amendment:

Prepare concise amendment language.

04

Obtain Approvals:

Get signoff from privacy and legal teams.

05

Execute:

Collect signatures and date of amendment.

06

Archive:

Store both original and amended copies.

Supporting documents and export formats to keep with the agreement

Assemble related evidence and use commonly supported formats to streamline audits and legal requests.

Data Map

Provide a current data inventory that lists categories, transfers, retention triggers, recipients, and lawful bases; export as CSV or PDF for regulator review.

Security Addendum

Attach a technical security specification describing encryption, key management, and access controls; store as PDF with version control.

Breach Log

Maintain an incident register with timestamps, impact assessment, and notification steps; commonly preserved as encrypted PDF or system export.

Audit Reports

Keep third-party audit summaries, penetration test results, and evidence of remediation in PDF format linked to the contract record.

Representative eSignature vendor comparison for SCC Controller Agreement workflows

Compare baseline pricing and key capabilities useful when selecting a platform for executing SCC Controller Agreements and associated records.

	signNow	DocuSign	Adobe Sign	PandaDoc	HelloSign
Starting Price	$8/user/mo	$15/user/mo	$14/user/mo	$19/user/mo	$15/user/mo
Free Trial	7-day free trial	No	No	Yes, limited	Yes, limited
Bulk Send	Yes	Yes	Yes	Yes	No
Audit Trail	Yes	Yes	Yes	Yes	Yes
HIPAA Compliant	Yes	Yes	Yes	No	No

Frequently asked questions about SCC Controller Agreements

Answers to common practical and legal questions about preparing, signing, and storing SCC Controller Agreements.

Need help? Contact support

What is an SCC Controller Agreement?
An SCC Controller Agreement implements the EU Standard Contractual Clauses for controller-to-controller transfers, documenting parties, data categories, purposes, and safeguards to meet GDPR transfer requirements.
Can this agreement be signed electronically?
Yes. Electronic signatures are generally enforceable under ESIGN and UETA in the United States when intent, consent, attribution, and retention are demonstrable and any sectoral rules are observed.
Do I need notarization or witnesses?
Not typically for data-transfer agreements; notarization is not a standard GDPR requirement. Follow state-specific formalities only if a local statute or counterparty requests notarization.
How quickly must breaches be reported?
Contract should require prompt notification to enable regulatory timelines; many regimes expect rapid notification of significant breaches to counterparties and authorities.
Who should sign the agreement?
An authorized officer or representative with authority to bind the entity; ensure the signature block states the signer's title and capacity to avoid enforceability questions.
How do I amend or revoke the agreement?
Use a written amendment executed by authorized signatories. Revocation should be handled per termination clauses with agreed transition and data return or deletion procedures.

be ready to get more

Join over 28 million airSlate SignNow users

Sign Now