STANDARD CONTRACTUAL CLAUSES (SCC) IMPLEMENTATION CHECKLIST

EU SCCs (2021) and UK Transfer Mechanisms

OVERVIEW

This checklist guides the implementation of Standard Contractual Clauses for international data transfers pursuant to GDPR Article 46(2)(c) and the Commission Implementing Decision (EU) 2021/914.

Important Dates:
- June 4, 2021: New EU SCCs adopted
- September 27, 2021: New SCCs required for NEW agreements
- December 27, 2022: Old SCCs no longer valid for ANY transfers

PART 1: PRE-IMPLEMENTATION ASSESSMENT

1.1 Determine Transfer Scenario

Which Module Applies?

1.2 Identify Parties

Data Exporter:

Data Importer:

1.3 Adequacy Check

Is the destination country covered by an adequacy decision?

☐ Yes - SCCs not required (but may still be used)

☐ No - SCCs or other Article 46 mechanism required

☐ Partial adequacy (check scope)

PART 2: TRANSFER IMPACT ASSESSMENT (TIA)

2.1 TIA Requirement

Has a Transfer Impact Assessment been conducted?

☐ Yes - Date: _________ Reference: _________

☐ No - STOP: TIA must be completed before implementing SCCs

2.2 TIA Findings

PART 3: SCC DOCUMENT PREPARATION

3.1 Select Applicable Clauses

Section I - General Provisions:

☐ Clause 1 - Purpose and scope

☐ Clause 2 - Effect and invariability of the Clauses

☐ Clause 3 - Third-party beneficiaries

☐ Clause 4 - Interpretation

☐ Clause 5 - Hierarchy (conflicts with other agreements)

3.2 Select Optional Provisions

Clause 7 - Docking Clause (Optional):

☐ Include docking clause (allows additional parties to join)

☐ Do not include docking clause

Clause 9 - Sub-processors (Module 2 and 3 only):

☐ Option 1: Prior specific authorization (list each sub-processor)

☐ Option 2: General written authorization (with notification right)

Clause 11 - Redress (Optional):

☐ Include optional text allowing data subjects to invoke dispute resolution

☐ Do not include optional text

Clause 17 - Governing Law:

☐ Option 1: EU Member State law allowing third-party beneficiary rights

☐ Option 2: Module 4 only - any EU Member State law

Selected Law: _____________

Clause 18 - Choice of Forum:

Courts of: _____________

3.3 Complete Annexes

Annex I - List of Parties:

☐ Part A - Data Exporter details completed

☐ Part B - Data Importer details completed

☐ Part C - Competent Supervisory Authority identified

Annex II - Technical and Organizational Measures (TOMs):

Annex III - List of Sub-processors (if applicable):

☐ Completed with all sub-processors

☐ Not applicable (specific authorization chosen)

PART 4: SUPPLEMENTARY MEASURES

4.1 Technical Measures

4.2 Contractual Measures

4.3 Organizational Measures

PART 5: UK TRANSFERS (IF APPLICABLE)

5.1 UK Transfer Mechanism Selection

For transfers from the UK:

☐ UK International Data Transfer Agreement (IDTA)

☐ UK Addendum to EU SCCs

☐ Both (for dual EU/UK transfers)

5.2 UK Addendum Checklist (if using)

☐ Part 1: Tables completed (parties, description, appendix information)

☐ Part 2: Mandatory Clauses incorporated

☐ EU SCCs attached with selected modules/options

☐ Addendum signed by both parties

5.3 UK IDTA Checklist (if using)

☐ Part 1: Tables A-D completed

☐ Table A: Parties and key contacts

☐ Table B: Transfer description

☐ Table C: Appendix information

☐ Table D: Ending the IDTA

☐ Part 2: Extra Protection Clauses (if required)

☐ IDTA signed by both parties

PART 6: EXECUTION AND DOCUMENTATION

6.1 Pre-Execution Review

☐ SCCs reviewed by legal counsel

☐ DPO consulted (if applicable)

☐ All annexes completed

☐ Supplementary measures documented

☐ TIA completed and attached

6.2 Execution

Signature Method:

☐ Wet ink signatures

☐ Electronic signatures (DocuSign, Adobe Sign, etc.)

☐ Written agreement (email exchange)

6.3 Documentation Storage

PART 7: ONGOING COMPLIANCE

7.1 Monitoring Activities

7.2 Change Management

Trigger events requiring review:

☐ Change in destination country laws

☐ Change in processing activities

☐ Addition of new sub-processors

☐ Supervisory authority guidance

☐ Security incident

☐ Data subject complaint

7.3 Data Subject Rights

☐ Process established to respond to data subject requests

☐ Importer cooperation procedures in place

☐ Complaint handling mechanism documented

PART 8: APPROVAL AND SIGN-OFF

8.1 Implementation Approval

8.2 Checklist Completion

☐ All required sections completed

☐ All documents gathered and stored

☐ SCCs properly executed

☐ Ongoing monitoring schedule established

☐ Staff trained on procedures

DOCUMENT CONTROL

QUICK REFERENCE: MODULE SELECTION

This checklist is provided for compliance with GDPR international transfer requirements. It does not constitute legal advice. Consult with qualified legal counsel for specific implementation questions.