Implementing Standard Contractual Clauses

Overview

Commission Implementing Decision (EU) 2021/914 of 4 June 2021 introduced modernised Standard Contractual Clauses (SCCs) for the transfer of personal data to third countries under Regulation (EU) 2016/679. These SCCs replaced the prior sets adopted under Directive 95/46/EC and became the mandatory instrument from 27 December 2022. The modular architecture allows parties to select the appropriate clause set based on their roles in the transfer relationship.

Module Selection Decision Framework

Module 1: Controller to Controller (C2C)

When to use: The data exporter is a controller and the data importer independently determines the purposes and means of processing the imported data as a separate controller.

Typical scenarios at Athena Global Logistics:

• Sharing shipment tracking data with overseas partner logistics firms that independently process that data for their own route optimisation
• Providing employee data to a foreign group entity that acts as an independent controller for local employment law compliance
• Transferring customer data to an overseas insurance partner that underwrites cargo policies under its own controllership

Key Module 1 clauses:

• Clause 8.1 — Data protection safeguards: The data importer must process data only for the specific purposes described in Annex I, with an independent legal basis under the importer's applicable law