---
title: "Standard Contractual Clauses (SCCs)"
description: "SCCs are EU-approved contract templates that make EEA-to-US data transfers lawful under GDPR Article 46. How they work with DPAs, Schrems II, and supplementary measures for AI tools."
url: "https://sonomos.ai/glossary/standard-contractual-clauses/"
source: "https://sonomos.ai/glossary/standard-contractual-clauses/"
---

# Standard Contractual Clauses (SCCs)

European Commission-approved contract templates that provide a lawful mechanism for transferring personal data from the EEA to countries without an adequacy decision, such as the United States.

## In depth

Standard Contractual Clauses are model contract terms adopted by the European Commission under GDPR Article 46 that bind a data importer outside the EEA to European data-protection standards. The 2021 modernised set is modular: Module 2 covers controller-to-processor transfers (the usual configuration when a company sends personal data to a US-based AI provider under a DPA) and Module 3 covers processor-to-sub-processor chains. Since the Schrems II judgment invalidated Privacy Shield in 2020, SCCs must be accompanied by a transfer impact assessment and, where the destination country's surveillance laws create risk, supplementary measures — the EDPB's Recommendations 01/2020 list technical measures such as encryption and pseudonymisation performed before the transfer, with the means of re-identification kept in the EEA. Most AI vendors' DPAs incorporate SCCs directly; many teams rely on them as the fallback mechanism even where the EU-US Data Privacy Framework provides an adequacy-based alternative, because adequacy arrangements have twice been struck down in court.

## Examples

- An EU company signing an AI vendor's DPA that incorporates the 2021 SCCs, Module 2, before allowing employees to process customer data with the tool.
- A transfer impact assessment documenting why SCCs plus on-device pseudonymisation adequately protect prompts sent to US inference infrastructure.
- A procurement review that rejects a vendor whose terms rely solely on an adequacy framework with no SCC fallback.

## How Locke handles standard contractual clauses (sccs)

Locke supplies the supplementary measure the EDPB recommends alongside SCCs: personal data is detected and replaced with placeholders on the user's device, inside the EEA, before the prompt crosses any border. The re-identification context stays local, so what the US importer receives is pseudonymized rather than raw personal data.

[See the product](https://sonomos.ai/locke/)

## Related terms

- GDPR

  The EU General Data Protection Regulation — the world's most comprehensive data-protection law, governing how organisations handle personal data of EU residents.
- Data Processing Agreement (DPA)

  A GDPR-mandated contract between a controller and a processor that governs how personal data is handled on the controller's behalf.
- Data Residency

  A commitment about the geographic location where data is stored and processed — and, for AI tools, three separate questions: where data rests, where inference runs, and who can access it remotely.
- Pseudonymization

  Replacing direct identifiers with stable pseudonyms so the data can no longer identify a person without additional information held separately.

## Reading on this topic

- [The Anthropic DPA Explained: Claude Data Processing Agreement Guide (2026)](https://sonomos.ai/blog/claude-dpa-explained-2026/)
- [Claude EU Data Residency in 2026: What Anthropic Offers, and What European Teams Do Instead](https://sonomos.ai/blog/claude-eu-data-residency-2026/)
- [GDPR and AI: A 2026 Compliance Guide for European Teams Using ChatGPT, Claude, and Gemini](https://sonomos.ai/blog/gdpr-ai-compliance-eu-chatgpt-claude-gemini-2026/)