Establishing secure connection…Loading editor…Preparing document…

Standard Contractual Clauses GDPR

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

STANDARD CONTRACTUAL CLAUSES (GDPR)

This Agreement is entered into on Effective Date: by and between Data Exporter: with address at and contact (Email: ) (hereinafter "Data Exporter"), and Data Importer: with address at and contact (Email: ) (hereinafter "Data Importer").

RECITALS

WHEREAS, the Data Exporter processes and transfers personal data belonging to data subjects located in the European Economic Area in the course of its business and desires to transfer such personal data to the Data Importer in a country outside the EEA where an adequacy decision is not in place;

WHEREAS, the parties intend that such transfers and subsequent processing shall be governed by the terms of this Agreement to ensure adequate safeguards for the protection of personal data in accordance with applicable data protection law, including the GDPR;

WHEREAS, the parties agree to implement and maintain technical and organizational measures and contractual obligations necessary to protect the rights of data subjects and to fulfill applicable legal obligations with respect to international data transfers.

NOW THEREFORE, in consideration of the mutual covenants set forth herein, the parties agree as follows:

1. Definitions

1.1. "Personal Data" means any information relating to an identified or identifiable natural person processed under this Agreement. 1.2. "Processing", "Controller", "Processor", "Data Subject", "Supervisory Authority" and "GDPR" have the meanings given in applicable data protection law. 1.3. Terms defined elsewhere in this Agreement shall have the meanings ascribed to them in the clause in which they appear.

2. Purpose and Scope

2.1. The subject matter of this Agreement is the transfer of Personal Data from the Data Exporter to the Data Importer for the purposes set out in this clause and the Annexes. The Data Importer shall process Personal Data only for the documented purposes: .

3. Data Transfer Details

3.1. Categories of Data Subjects: 3.2. Categories of Personal Data: 3.3. Special categories of data (if any): 3.4. Duration of Processing:

4. Obligations of the Parties

4.1. Data Exporter obligations. The Data Exporter represents and warrants that to the extent it is a Controller with respect to the Personal Data, it has a lawful basis for the transfer and processing described herein and has provided any required notices to Data Subjects. The Data Exporter shall promptly notify the Data Importer of any limitations imposed on the processing or any requests from data subjects that may affect the transfer.

4.2. Data Importer obligations. The Data Importer shall process Personal Data only on documented instructions from the Data Exporter, implement appropriate technical and organizational measures, ensure that persons authorized to process Personal Data have committed to confidentiality, and not engage additional third-party processors except as permitted in Clause 6.

5. Security Measures

5.1. The Data Importer shall implement and maintain appropriate technical and organizational measures to ensure the security of Personal Data, including measures to protect against unauthorized or unlawful processing and against accidental loss, destruction or damage. Describe minimum measures and standards to be met:

6. Subprocessors

6.1. The Data Importer shall not engage any subprocessor without the prior written authorization of the Data Exporter. The Data Importer shall provide the Data Exporter with written notice of any intended changes concerning the addition or replacement of subprocessors, including the identity and location of such subprocessors.

6.2. Authorized subprocessors (if any): 6.3. The Data Importer shall contractually require each subprocessor to provide at least the same level of protection for Personal Data as set out in this Agreement.

7. Data Subject Rights and Assistance

7.1. The parties shall cooperate to enable the Data Exporter to comply with obligations to respond to requests from Data Subjects exercising their rights. The Data Importer shall provide reasonable assistance within the timeframes required by law and as necessary to enable the Data Exporter to respond to Data Subject requests.

8. Personal Data Breach

8.1. The Data Importer shall notify the Data Exporter without undue delay, and in any event within hours after becoming aware of a Personal Data breach affecting Personal Data transferred under this Agreement, providing details to allow the Data Exporter to meet any regulatory notification obligations.

9. Audit and Inspection

9.1. The Data Importer shall allow and contribute to audits, including inspections, conducted by the Data Exporter or an auditor mandated by the Data Exporter, upon reasonable notice and subject to any confidentiality obligations. The Data Importer will make available records demonstrating compliance with the obligations set out in this Agreement.

10. Return or Deletion of Personal Data

10.1. Upon termination or expiry of this Agreement, the Data Importer shall, at the choice of the Data Exporter, delete or return all Personal Data and existing copies within days, unless applicable law requires storage of the Personal Data. If deletion is requested, the Data Importer shall certify in writing to the Data Exporter that it has complied with this obligation.

11. Liability and Indemnity

11.1. Each party shall be responsible for any breach of this Agreement caused by its own actions or omissions. The Data Importer shall indemnify and hold harmless the Data Exporter from losses arising from the Data Importer’s failure to comply with its data protection obligations under this Agreement.

11.2. Liability limitations agreed by the parties:

12. Governing Law and Jurisdiction

12.1. This Agreement shall be governed by and construed in accordance with the laws of . Any disputes arising out of or in connection with this Agreement shall be subject to the exclusive jurisdiction of the competent courts of , unless the parties agree otherwise in writing.

13. Notices

13.1. All notices, requests, consents and other communications required or permitted under this Agreement shall be in writing and sent to the contacts set out below (or as otherwise notified in writing):

14. Miscellaneous

14.1. Amendments. Any amendment or modification of this Agreement shall be in writing and signed by both parties. 14.2. Waiver. No waiver of any provision hereof shall be effective unless in writing and signed by the waiving party. 14.3. Severability. If any provision of this Agreement is held to be invalid or unenforceable, the remainder shall remain in full force and effect. 14.4. Entire Agreement. This Agreement, including any Annexes and attachments, constitutes the entire agreement between the parties with respect to the subject matter hereof and supersedes all prior agreements and understandings relating thereto. 14.5. Counterparts. This Agreement may be executed in counterparts, each of which shall be deemed an original and all of which together shall constitute one and the same instrument.

Signatories

For Data Exporter:

By:

Date:

For Data Importer:

By:

Date:

Enter text✕
Prepare your document for signing right on this page
  • 01 Edit the text and complete the fields
  • 02 Click Sign Now and on the next screen add recipients and signature fields in SignNow
  • 03 Start your free trial to sign and send your doc
Sign Now

What the Standard Contractual Clauses GDPR Are

Standard Contractual Clauses GDPR (commonly “SCCs”) are pre‑approved contractual terms that allocate data protection obligations between an EU/EEA exporter and a non‑EU importer to lawfully transfer personal data outside the EU. Adopted and updated by the European Commission, SCCs set technical, organizational, and contractual safeguards and remain a primary legal mechanism for international transfers where adequacy decisions do not apply. U.S. organizations using SCCs should map transferred data, ensure contractual obligations align with operational practices, and document supplementary measures when necessary to meet GDPR requirements.

Why SCCs Matter for U.S. Organizations

SCCs provide a standardized, legally recognized framework to authorize transfers of EU personal data to U.S. entities when no adequacy decision exists. They clarify responsibilities for security, subprocessors, audits, and data subject rights while reducing negotiation time compared with bespoke clauses.

Why SCCs Matter for U.S. Organizations

Who Typically Completes Standard Contractual Clauses GDPR

Legal, privacy, and operational teams jointly complete SCCs: legal drafts and negotiates contract language, privacy teams map data flows and controls, and operations implement technical safeguards.

  • Legal counsel and general counsel teams who review liability, indemnities, and jurisdiction clauses for cross‑border exposure.
  • Data protection officers and privacy leads who identify categories of personal data and required technical/organizational measures.
  • IT or security teams who confirm encryption, access control, and logging commitments can be implemented and monitored.

Final execution requires authorized signatories from both parties and documented evidence that operational controls match contractual commitments.

Core Elements to Include in Professional SCCs

A complete SCC addendum organizes transfer scope, legal obligations, security measures, subprocessors, liability, and data subject support. Each element should be precise, consistent with your Data Processing Agreement, and aligned with how you operate technically and organizationally.

Parties

Identify exporter and importer legal names, addresses, and contact details exactly as registered; include role (controller or processor) and representative if applicable.

Scope of Transfer

Describe data categories, processing purposes, and transfer pathways so obligations apply only to documented transfers rather than broader, undefined processing.

Security Measures

List technical and organizational measures (encryption, access control, incident response) and map them to operational controls to demonstrate enforceability.

Subprocessors

Specify subprocessors, approval process, and flow‑down obligations so the exporter can audit or object to critical third parties.

Data Subject Rights

Detail procedures for handling access, rectification, erasure, and data portability requests from EU data subjects, including response timeframes.

Liability & Termination

Define liability caps, indemnities, and post‑termination obligations such as return or deletion of personal data and certification of compliance.

Required Information Elements

Exporter Name: Legal entity name
Importer Name: Legal entity name
Data Categories: Personal data types
Processing Purpose: Clear business purpose
SCC Module: Controller‑controller or controller‑processor
Effective Date: Start date of transfer

Step‑by‑Step: Preparing and Executing SCCs

Follow these practical steps to ensure SCCs are accurate, consistent, and enforceable across technical and legal teams.

  • 01
    Map transfers: Inventory data flows and recipients before drafting clauses
  • 02
    Select module: Choose the SCC module matching controller/processor roles
  • 03
    Assess safeguards: Document technical and organizational measures and supplementary steps
  • 04
    Execute and retain: Have authorized signatories sign and store executed SCCs

How to Customize and Complete SCCs Online

Set up a repeatable online workflow that combines legal templates with technical evidence and signer authentication to streamline SCC execution.

Field Configuration
Template Upload standard SCC template to platform
Prefill Auto‑populate exporter/importer fields from CRM
Signer Auth Enable two‑factor or email+SMS verification
Audit Trail Retain audit log and signed PDF for records

Where to Send and How SCCs Are Routed

Establish a single routing pattern to reduce errors: legal review, privacy sign‑off, technical attestation, then signature by authorized representative.

  • Legal review: Legal checks liability and compatibility with other agreements
  • Privacy validation: Privacy team confirms lawful basis and required safeguards
  • Technical attestation: Security team verifies controls and documentation
  • Execution: Authorized signatory signs and each party retains a copy

Digital Signing and eSubmission Requirements

Use an eSignature platform that supports strong signer authentication, tamper‑evident signed PDFs, and an audit trail to maintain enforceability.

  • File formats: PDF and DOCX supported
  • Authentication: Email+SMS or advanced methods
  • Retention: Secure storage with audit trail

Ensure the chosen platform can export a signed, tamper‑evident PDF and retain metadata (timestamps, IP addresses) to support attribution and record reproduction.

Timelines and Typical Processing Expectations

SCCs themselves do not have filing deadlines, but associated tasks have timeframes: legal review, security attestation, and operational implementation should be scheduled and tracked.

Legal review timeframe:

Allow 5–15 business days depending on negotiation scope

Technical attestation:

Typically 3–10 business days for controls verification

Signature turnaround:

Electronic signing often completes within 24–72 hours

Subprocessor update notice:

Provide advance notice per SCC terms, often 30 days

Supplementary measures:

Implement promptly; document steps before the next transfer

Common Mistakes When Preparing SCCs

  • Using a generic SCC template without mapping actual data flows, which can leave obligations unenforceable or misaligned.
  • Failing to record or evidence technical measures promised in the SCC, undermining the exporter’s ability to demonstrate compliance.
  • Not updating SCCs when subprocessors change, which can breach the clause requiring prior notice or approval.
  • Overlooking the need for supplementary measures (encryption, access restrictions) where local law or foreign access risks exist.

Penalties and Legal Risks of Incorrect SCCs

GDPR fines: Article 83 fines possible
Contract liability: Breach damages and indemnities
Regulatory action: Data protection authority enforcement
Operational risk: Interruption of cross‑border processing
Reputational harm: Public enforcement notices
Litigation: Class actions or individual claims

eSignature Vendor Pricing and Feature Comparison

Compare core pricing and capabilities for SCC execution, with signNow listed first. Use plan tier and compliance needs (HIPAA, audit trail, bulk send) to guide vendor selection.

signNow DocuSign Adobe Sign PandaDoc HelloSign
Starting Price $8/user/mo $15/user/mo $14/user/mo $19/user/mo $15/user/mo
Free Trial 7‑day trial Varies Varies Varies Varies
Bulk Send Yes Yes Yes Yes No
Audit Trail Yes Yes Yes Yes Yes
HIPAA Compliant Yes Yes Yes No No

Electronic Signature vs Digital (PKI) Signature — Key Differences

Understand the distinction: digital signatures use PKI cryptography, while electronic signatures are a broader legal category accepted under ESIGN and UETA.

Criteria Electronic Signature Digital Signature
Definition any electronic process pki cryptographic certificate
Technology varied methods public‑key infrastructure
Non‑repudiation audit trail evidence strong cryptographic non‑repudiation
Common use contracts, forms high‑assurance regulatory records

Who Is Authorized to Sign SCCs

Data Protection Officer

The DPO or designated privacy lead often prepares and certifies technical and organizational measures, but execution usually requires a corporate officer with contract authority.

Authorized Signatory

An executive with contracting authority (e.g., CFO, General Counsel, VP Legal) should sign to bind the legal entity and confirm enforceability.

Key Milestones for SCC Execution

Track these milestone stages to maintain compliance and realize operational handoffs during SCC negotiation and execution.

01

Inventory Complete

Data map and list of recipients completed

02

Legal Drafting

SCC template reviewed and adapted to scope

03

Technical Attestation

Security controls verified and documented

04

Final Execution

Authorized signatories sign and copies archived

FAQs and Common Issues

Answers to frequent questions about using Standard Contractual Clauses GDPR with U.S. operations, including signature methods, supplementary measures, and recordkeeping.


Need help? Contact support

be ready to get more
Join over 28 million airSlate SignNow users
Sign Now
Company
Forms
Pricing
Resources
Knowledge base
Other Products
© 2026 airSlate Inc. All rights reserved.