A provider sent us standard contractual clauses (SCCs) – how do we pick the module and fill in the annexes?

The SCCs have four modules. The module depends on what you are and what the recipient outside the European Economic Area (EEA) is.

For a small company Module Two is the usual fit: you control customer or employee data, and the service provider processes it on your behalf.

One warning. These SCCs may be used only to the extent that the importer's processing does not fall within the scope of the GDPR (recital 7 of Decision 2021/914). This is judged per processing, not by whether the provider does business in the EU at all. If the recipient's processing of these particular data is already subject to the GDPR under Article 3(2) GDPR (it relates to offering goods or services to people in the EU or to monitoring their behaviour), this set of SCCs is not designed for that processing. In that case talk to a lawyer.

Annex I has three sections (in Module Four, two: A and B). They are filled in as free text.

Section A – the parties. For each party: name, address, contact person's name, position and contact details, activities relevant to the transfer, role (controller or processor), signature and date. For the exporter, also its EU representative and the contact details of the person responsible for data protection, where appointed.

Section B – description of the transfer. This is most of the work. The fields are:

1. categories of data subjects, for example "online shop customers";
2. categories of personal data transferred;
3. sensitive data, if any, and the restrictions or safeguards applied to it;
4. frequency of the transfer – one-off or continuous;
5. nature of the processing;
6. purposes of the transfer and further processing;
7. retention period, or the criteria used to set it;
8. for transfers to processors – subject matter, nature and duration of the processing.

Our recommendation: copy these fields from the entry in your record of processing activities. They are already there, and two versions that do not match are worse than one.

Section C – the supervisory authority. If the exporter is established in Lithuania, write the State Data Protection Inspectorate (VDAI). Clause 13(a) of the SCCs makes the authority supervising the exporter the competent one, and in Lithuania the GDPR is supervised by VDAI (Article 7(1) of the Law on the Legal Protection of Personal Data, ADTAĮ).

Annex II – security measures. The SCCs' own explanatory note requires the measures to be described in specific, not generic, terms. The sentence "the provider applies industry standards" does not work. This does, for example: "data is encrypted in transit and at rest; access only with two-factor authentication; login logs kept for 12 months". The Annex gives a list of example measures. It is worth going through it item by item, for example: encryption, restoring after an incident, access control, physical security, logging. Where the provider fills in this Annex itself, your job is to read it and ask what is missing.

Annex III – sub-processors. It is required for Modules Two and Three only where Clause 9 uses specific authorisation (Clause 9(a), Option 1). Where general authorisation is chosen, the provider usually gives its sub-processor list by link – save a dated copy of it.

The SCC text contains blanks and options. You may fill in or choose them; you may not change the text.

Signed SCCs do not finish the job. Clause 14(d) of the SCCs requires the parties to document the assessment of whether the laws and practices of the destination country prevent the importer from complying with the clauses, and to make it available to the supervisory authority on request. The EDPB Recommendations 01/2020 split this work into six steps. For a small company they become one file with these sheets:

1. List of transfers. Which providers, in which countries, which data. The EDPB reminds that remote access from a third country, for example technical support, and storage in a cloud outside the EEA also count as a transfer (paragraph 13 of EDPB Recommendations 01/2020).
2. Transfer tool. An adequacy decision, SCCs or another Chapter V GDPR tool (for example another Article 46 tool or, for occasional cases, an Article 49 derogation).
3. Assessment. Clause 14(b) of the SCCs lists what is taken into account: the specific circumstances of the transfer, the law and practice of the destination country, and any supplementary safeguards. Under Clause 14(c) the provider warrants that it has made its best efforts to give you the relevant information, and agrees to keep cooperating. Ask it for that information. If it has its own assessment, attach it to the file as a source, but write your own conclusion.
4. Supplementary measures. For example, encryption where you hold the keys.
5. The signed SCCs with their annexes.
6. Review date. The EDPB's sixth step is to re-evaluate at appropriate intervals. Our recommendation – once a year and whenever the provider reports a change.

In the record, enter the transfer to a third country and the name of that country next to the process (Article 30(1)(e) GDPR). Our recommendation – also add the tool, for example "SCC, Module Two, signed 2026-03-10", and a pointer to the file.

In the privacy notice you must state the intention to transfer data to a third country, whether a Commission adequacy decision exists, and where you rely on Article 46, the safeguards and how to obtain a copy of them or where they have been made available (Article 13(1)(f) GDPR; where the data was not obtained from the person – Article 14(1)(f)).

For a US company included in the Data Privacy Framework List, the transfer rests on a Commission adequacy decision (Article 1 of Decision 2023/1795; Article 45(1) GDPR). Before signing, check the list: whether the provider is on it, whether its certification is active and whether it covers your type of data. Put a dated screenshot into the file. If the provider is not on the list, you need another tool from Chapter V GDPR – for a small company, most often SCCs.

Today, list every provider whose servers or support sit outside the EEA and mark the module next to each one. Then fill in Section B of Annex I from your record. With the tool (in Lithuanian) you can find out free of charge whether you must keep a record of processing activities – the transfer file starts there too.

May we edit the SCC text so that it fits our contract?
No. You may select the module, choose the options the text provides and complete the annexes. The SCCs may be included in a wider contract and other clauses may be added, as long as they do not contradict the SCCs directly or indirectly or prejudice the fundamental rights or freedoms of data subjects (Clause 2(a) of the SCCs).

The provider has its own data processing agreement with SCCs built in. Do we need a separate document?
Not necessarily. Check three things: which module is selected, whether the annexes are completed, and whether you are named correctly in them – as the controller.

Do we need SCCs if the provider's servers are in the EU but support comes from India?
In the EDPB's view, remote access from a third country is also a transfer (paragraph 13 of EDPB Recommendations 01/2020). Ask the provider which transfer tool it uses for its support team and put the answer into the file.

Who must see the transfer assessment?
The supervisory authority, if it asks (Clause 14(d) of the SCCs). The SCCs do not require you to show it to a client or to a person, but a client may ask about it in its questionnaire.

• Are SCCs needed when the provider is outside the EU? (in Lithuanian)
• Do we need a data processing agreement with our IT provider? (in Lithuanian)
• Sharing customer data with a partner: a five-step check
• Describing your security measures

The law and the risk: Transferring personal data outside the EEA: when SCCs are needed – dat.lt

• The SCC text and its invariability – Commission Implementing Decision (EU) 2021/914, Clause 2(a) of the Annex; when the SCCs do not fit – recital 7
• Optional clauses – Clauses 7, 9, 11, 13, 17 and 18 of the SCCs; the assessment – Clause 14(b), (c) and (d); annexes – Annexes I, II and III
• When the record does not apply – Article 30(5) GDPR; territorial scope – Article 3(2)
• Appropriate safeguards – Article 46(1) and 46(2)(c) GDPR; adequacy decisions – Article 45(1)
• EU–US Data Privacy Framework – Commission Implementing Decision (EU) 2023/1795, Article 1
• Transfers in the record – Article 30(1)(e) GDPR
• Informing people about transfers – Article 13(1)(f) and Article 14(1)(f) GDPR
• Supervisory authority in Lithuania – Article 7(1) of the Law on the Legal Protection of Personal Data (ADTAĮ)
• Contracts for the benefit of a third party – Article 6.191(1) of the Civil Code (CK)
• Six steps and remote access – EDPB Recommendations 01/2020, version 2.0, paragraphs 8–13 and 67–68

Legal texts checked on 2026-09-25: GDPR – official consolidated English text (02016R0679) with corrigenda; Decision 2021/914 – OJ L 199, 7.6.2021; ADTAĮ – e-tar.lt edition in force from 2026-06-30; CK – e-tar.lt edition in force from 2026-07-31. This text is general information and is not individual legal advice.