Do you need Standard Contractual Clauses (SCCs) when a supplier is outside the EU?
Short answer
It depends on the country. If the European Commission has adopted an adequacy decision for that country, you do not need SCCs. If not — you do, and you need to check the whole chain.
On this page
1.The first question — does the country have an adequacy decision
Start not with the contract, but with the country. If the European Commission has adopted an adequacy decision, the transfer works the same way as within the European Union: no separate instrument is needed.
This means the ordinary data processing provisions in the contract are enough. Adding SCCs anyway is not prohibited, but it adds nothing and often confuses the negotiation.
The list of adequacy decisions changes, so check it at the time you sign the contract, rather than relying on something you heard three years ago.
2.The United Kingdom is an adequate country
SCCs are not needed for transfers to the United Kingdom. In December 2025 the European Commission renewed the UK's GDPR adequacy decision, and it remains valid until 27 December 2031.
In practice this means a British cloud service provider, an accounting service, or a group company in London does not require a separate transfer instrument. You still record the transfer in the register — only the legal basis is the adequacy decision, not SCCs.
It is worth noting the date in your calendar. If the decision expires and is not renewed, the same suppliers would then need SCCs.
Source
The list of current adequacy decisions is published by the European Commission.
European Commission: adequacy decisions3.When there is no adequacy decision
Then the transfer needs one of the instruments under Chapter V of the GDPR. The most commonly used are Standard Contractual Clauses — a Commission-approved text that is attached to the contract and not altered.
SCCs come with a practical part: you need to assess whether the law of the destination country would prevent you from complying with them, and if necessary agree additional measures, such as encryption. This assessment needs to be in writing.
| Situation | Are SCCs needed |
|---|---|
| Supplier in the EU / EEA | No |
| Supplier in the United Kingdom | No — adequacy decision valid until 2031-12-27 |
| Supplier in a country with an adequacy decision | No |
| Supplier elsewhere | Yes, or another Chapter V instrument |
| Same group, company outside the EU | Yes — an internal agreement alone is not enough |
4.SCCs are also needed within a group
A transfer to a parent company is a transfer just like one to an outside supplier. An internal group agreement alone is not enough.
There are two routes: either the internal agreement incorporates Standard Contractual Clauses, or the group has approved Binding Corporate Rules (BCRs). There is no third option based on common ownership alone.
5.Check the whole chain, not just the first supplier
A supplier in the European Union can have a sub-processor outside it. A contract with a company registered in Vilnius says nothing about where the support team or the backup server actually operates.
So ask in writing, before signing. Record the answer in the register entry, so you do not need to look for it again next time.
What to ask the supplier in writing
- Which group companies and sub-processors are involved in the processing?
- Which country is each of them in?
- What instrument is each transfer stage based on?
Official legal text
We do not paraphrase the regulation's provisions here. The official Lithuanian text of the GDPR is available in one place and is more precise than any summary.
GDPR text in Lithuanian (EUR-Lex)