GDPR Cross-Border Transfers: SCCs and Data Transfers

A cross-border data transfer occurs when personal data is transmitted to a recipient in a country outside the European Economic Area (EEA). Article 44 GDPR establishes that such transfers are only permissible under specific conditions — for example, based on an adequacy decision, appropriate safeguards such as standard contractual clauses, or derogations under Article 49 GDPR. Even remote access from a third country to data stored in the EEA qualifies as a transfer. ADVISORI helps you identify and legally assess all cross-border transfers in your organisation.

Since 27 December 2022, only the new EU standard contractual clauses issued by the European Commission in June 2021 are valid. They cover four modules: Controller-to-Controller (Module 1), Controller-to-Processor (Module 2), Processor-to-Processor (Module 3), and Processor-to-Controller (Module 4). A transfer impact assessment (TIA) is additionally required for every SCC-based transfer. ADVISORI assists with module selection, contract adaptation, and TIA execution.

The Schrems II ruling by the CJEU in July 2020 invalidated the EU-US Privacy Shield and tightened requirements for all transfer instruments. Companies must now individually assess whether the data protection level in the destination country is essentially equivalent to EU standards for each transfer. SCCs alone may not suffice — supplementary technical and organisational measures are required where the destination country does not provide adequate protection. ADVISORI evaluates your transfers against Schrems II criteria and recommends appropriate supplementary measures.

A transfer impact assessment (TIA) is the mandatory risk evaluation for every data transfer based on standard contractual clauses or binding corporate rules. It examines whether the legal framework in the destination country could compromise the protection of transferred data — particularly through government access powers. The assessment covers analysis of local legislation, government access practices, and the effectiveness of agreed safeguards. ADVISORI conducts TIAs systematically and documents results in an audit-proof manner.

The EU-US Data Privacy Framework (DPF) is the adequacy decision adopted by the EU Commission in July 2023 for the United States. It permits data transfers to US companies certified with the US Department of Commerce without additional safeguards like SCCs. Certification is verified via the DPF list. Important: The decision only covers certified companies — for non-certified US recipients, SCCs and TIAs remain required. ADVISORI verifies your US partners certification status and advises on optimal transfer strategies.

Articles 46 and 49 GDPR provide several transfer mechanisms: adequacy decisions by the EU Commission (Article 45), standard contractual clauses (Article 46(2)(c)), binding corporate rules for corporate groups (Article 47), approved codes of conduct (Article 46(2)(e)), and certifications (Article 46(2)(f)). For individual cases, derogations under Article 49 GDPR apply, such as explicit consent or contract performance. ADVISORI evaluates which mechanism best suits your specific transfers.

ADVISORI guides you through building a structured cross-border transfer management programme: We start with a comprehensive inventory of all international data flows, assess legal bases, and conduct transfer impact assessments. We then implement appropriate transfer mechanisms, train your staff, and establish ongoing monitoring so you can respond promptly to regulatory changes — such as new adequacy decisions or court rulings.