In depth
Standard Contractual Clauses are model contract terms adopted by the European Commission under GDPR Article 46 that bind a data importer outside the EEA to European data-protection standards. The 2021 modernised set is modular: Module 2 covers controller-to-processor transfers (the usual configuration when a company sends personal data to a US-based AI provider under a DPA) and Module 3 covers processor-to-sub-processor chains. Since the Schrems II judgment invalidated Privacy Shield in 2020, SCCs must be accompanied by a transfer impact assessment and, where the destination country's surveillance laws create risk, supplementary measures — the EDPB's Recommendations 01/2020 list technical measures such as encryption and pseudonymisation performed before the transfer, with the means of re-identification kept in the EEA. Most AI vendors' DPAs incorporate SCCs directly; many teams rely on them as the fallback mechanism even where the EU-US Data Privacy Framework provides an adequacy-based alternative, because adequacy arrangements have twice been struck down in court.
Examples
- An EU company signing an AI vendor's DPA that incorporates the 2021 SCCs, Module 2, before allowing employees to process customer data with the tool.
- A transfer impact assessment documenting why SCCs plus on-device pseudonymisation adequately protect prompts sent to US inference infrastructure.
- A procurement review that rejects a vendor whose terms rely solely on an adequacy framework with no SCC fallback.
How Locke handles standard contractual clauses (sccs)
Locke supplies the supplementary measure the EDPB recommends alongside SCCs: personal data is detected and replaced with placeholders on the user's device, inside the EEA, before the prompt crosses any border. The re-identification context stays local, so what the US importer receives is pseudonymized rather than raw personal data.
See the productRelated terms
- GDPR
The EU General Data Protection Regulation — the world's most comprehensive data-protection law, governing how organisations handle personal data of EU residents.
- Data Processing Agreement (DPA)
A GDPR-mandated contract between a controller and a processor that governs how personal data is handled on the controller's behalf.
- Data Residency
A commitment about the geographic location where data is stored and processed — and, for AI tools, three separate questions: where data rests, where inference runs, and who can access it remotely.
- Pseudonymization
Replacing direct identifiers with stable pseudonyms so the data can no longer identify a person without additional information held separately.
