Overview
Commission Implementing Decision (EU) 2021/914 of 4 June 2021 introduced modernised Standard Contractual Clauses (SCCs) for the transfer of personal data to third countries under Regulation (EU) 2016/679. These SCCs replaced the prior sets adopted under Directive 95/46/EC and became the mandatory instrument from 27 December 2022. The modular architecture allows parties to select the appropriate clause set based on their roles in the transfer relationship.
Module Selection Decision Framework
Module 1: Controller to Controller (C2C)
When to use: The data exporter is a controller and the data importer independently determines the purposes and means of processing the imported data as a separate controller.
Typical scenarios at Athena Global Logistics:
- Sharing shipment tracking data with overseas partner logistics firms that independently process that data for their own route optimisation
- Providing employee data to a foreign group entity that acts as an independent controller for local employment law compliance
- Transferring customer data to an overseas insurance partner that underwrites cargo policies under its own controllership
Key Module 1 clauses:
- Clause 8.1 — Data protection safeguards: The data importer must process data only for the specific purposes described in Annex I, with an independent legal basis under the importer's applicable law
- Clause 8.2 — Purpose limitation: The importer shall not process data for purposes incompatible with those for which the data was transferred
- Clause 8.3 — Transparency: The importer must provide data subjects with a copy of the clauses and Annex I information upon request
- Clause 8.4 — Accuracy: Both parties must take reasonable steps to ensure data is accurate and up to date
- Clause 8.5 — Duration and erasure: Data processed only for the duration specified in Annex II; erasure or return upon termination
Module 2: Controller to Processor (C2P)
When to use: The data exporter is a controller and the data importer processes data on behalf of the exporter as a processor.
Typical scenarios at Athena Global Logistics:
- Engaging a cloud infrastructure provider headquartered in a third country to host the transport management system
- Using an overseas payroll processing bureau to calculate salaries for locally-hired staff
- Contracting a third-country call centre to handle customer service inquiries on behalf of the company
Key Module 2 clauses:
- Clause 8.1 — Instructions: The processor shall process data only on documented instructions from the controller as specified in Annex II
- Clause 8.2 — Purpose limitation: Processing solely for the specific purposes set out in Annex I
- Clause 8.3 — Transparency: Controller must inform data subjects of the transfer and identity of the importer
- Clause 8.5 — Sub-processing: Sub-processors only with prior specific or general written authorisation; same data protection obligations imposed by contract
- Clause 8.6 — International onward transfers: Sub-processor transfers require the same level of protection
- Clause 8.8 — Security: Technical and organisational measures as described in Annex II
- Clause 8.9 — Documentation and compliance: Processor must maintain records and allow audits
Module 3: Processor to Processor (P2P)
When to use: The data exporter is a processor (acting on behalf of an EU controller) and the data importer is a sub-processor.
Typical scenarios at Athena Global Logistics:
- The company acts as a data processor for a European shipping consortium and sub-contracts warehousing data management to a third-country sub-processor
- A managed IT services provider contracted by the company further sub-processes personal data with an offshore development centre
Key Module 3 clauses:
- Clause 8.1 — Instructions: Sub-processor processes only under the chain of instructions ultimately originating from the controller
- Clause 8.5 — Onward sub-processing: Further sub-processing only with prior specific or general written authorisation from the controller (obtained through the initial processor)
- Clause 8.8 — Security measures: Annex II security measures apply equivalently
- Clause 8.9 — Documentation and compliance: Full audit chain maintained back to the controller
Module 4: Processor to Controller (P2C)
When to use: The data exporter is a processor and the data importer is the controller whose data is being returned or transferred.
Typical scenarios at Athena Global Logistics:
- Returning processed analytics results to a non-EU client controller who originally provided the raw shipment data
- A European cloud processor returning personal data to its non-EU controller client upon contract termination
Key Module 4 clauses:
- Clause 8.1 — The importer shall process data in compliance with its obligations under the GDPR (where applicable) or equivalent standards
- Clause 8.2 — Purpose limitation and transparency obligations on the importer as controller
Module Selection Decision Tree
START: Identify the role of the data EXPORTER (EU-based party)
|
├── Exporter is a CONTROLLER
| |
| ├── Importer determines its OWN purposes → MODULE 1 (C2C)
| |
| └── Importer processes ON BEHALF of exporter → MODULE 2 (C2P)
|
└── Exporter is a PROCESSOR
|
├── Importer is a SUB-PROCESSOR → MODULE 3 (P2P)
|
└── Importer is the CONTROLLER (data return) → MODULE 4 (P2C)
Annex I: List of Parties and Transfer Details
Section A — List of Parties
| Field | Data Exporter | Data Importer |
|---|---|---|
| Name | Athena Global Logistics GmbH | TransPacific Freight Solutions Ltd |
| Address | Friedrichstrasse 112, 10117 Berlin, Germany | 88 Harbour Road, Wan Chai, Hong Kong SAR |
| Contact person | Elisa Brandt, Head of Data Protection | James Leung, Chief Privacy Officer |
| Activities relevant to transfer | International freight forwarding, customs brokerage, warehouse management for European operations | Regional freight consolidation, last-mile delivery coordination, customs clearance for Asia-Pacific operations |
| Role | Controller | Processor (Module 2) |
Section B — Description of Transfer
| Element | Detail |
|---|---|
| Categories of data subjects | Shipping customers (consignors and consignees), employees of customer companies, customs brokers, warehouse workers |
| Categories of personal data | Full name, business email, business phone number, company name, shipping address, customs identification numbers, consignment reference numbers, delivery scheduling preferences |
| Sensitive data | None transferred under this agreement |
| Frequency of transfer | Continuous real-time transfer via API integration; batch file transfer daily at 02:00 UTC |
| Nature of processing | Storage, retrieval, matching of consignment records, generation of customs documentation, delivery status tracking, exception reporting |
| Purpose of transfer | Fulfilment of freight forwarding contracts requiring regional processing of shipment data for customs clearance and last-mile delivery in Asia-Pacific jurisdictions |
| Retention period | 36 months from completion of the relevant shipment, after which data is securely deleted in accordance with Annex III procedures |
Section C — Competent Supervisory Authority
The competent supervisory authority is the Berliner Beauftragte für Datenschutz und Informationsfreiheit (BlnBDI), identified in accordance with Clause 13 as the supervisory authority of the Member State in which the data exporter is established.
Annex II: Technical and Organisational Measures
| Measure Category | Specific Measures Implemented |
|---|---|
| Encryption of data in transit | TLS 1.3 for all API communications; SFTP with AES-256 encryption for batch transfers |
| Encryption of data at rest | AES-256 encryption on all database storage volumes; encrypted backup tapes with separate key management |
| Access control | Role-based access control (RBAC) with least-privilege principle; multi-factor authentication for all administrative access; quarterly access reviews |
| Data minimisation | API payloads stripped of fields not required for the specific processing purpose; data masking applied to non-essential personal identifiers in development and testing environments |
| Logging and monitoring | Centralised SIEM with 12-month log retention; real-time alerting on anomalous access patterns; daily log review by security operations centre |
| Incident response | Documented incident response plan with 24-hour initial assessment SLA; notification to data exporter within 48 hours of confirmed breach; annual tabletop exercises |
| Physical security | ISO 27001-certified data centres; biometric access controls; 24/7 CCTV surveillance; clean desk policy in processing areas |
| Business continuity | RPO of 4 hours and RTO of 8 hours; geographically separated disaster recovery site; annual DR testing with documented results |
| Staff measures | Mandatory data protection training upon onboarding and annually thereafter; background checks for all staff with access to personal data; confidentiality agreements |
| Sub-processor management | Due diligence assessment before engagement; contractual flow-down of equivalent security obligations; annual audit of sub-processor compliance |
Annex III: List of Sub-Processors
| Sub-Processor | Location | Processing Activity | Safeguard Mechanism |
|---|---|---|---|
| CloudVault Asia Pte Ltd | Singapore | Cloud infrastructure hosting for the regional freight management platform | SCCs Module 3 (P2P) executed 15 March 2025 |
| Pinnacle Data Services Co Ltd | Bangkok, Thailand | Data entry and validation for customs documentation | SCCs Module 3 (P2P) executed 22 January 2025 |
Clause-by-Clause Implementation Checklist
Section I — General Clauses (All Modules)
| Clause | Subject | Implementation Action |
|---|---|---|
| Clause 1 | Purpose and scope | Confirm selected module is recorded in the preamble; verify parties have initialled the correct module |
| Clause 2 | Effect and invariability | Verify no modifications to the standard text; confirm any additional safeguards are in a separate addendum, not in the SCC body |
| Clause 3 | Third-party beneficiaries | Confirm data subjects can enforce Clauses 1-3, 8, 9, 12, 15-17 as third-party beneficiaries |
| Clause 4 | Interpretation | Confirm interpretation aligned with GDPR; terms have the same meaning as in the Regulation |
| Clause 5 | Hierarchy | Verify that in case of contradiction, the SCCs prevail over other contractual arrangements |
| Clause 6 | Description of transfer | Verify Annex I.B is complete with all required elements |
| Clause 7 | Docking clause | Determine if additional parties will accede; if so, prepare Annex I.A amendment procedure |
Section II — Obligations of the Parties
| Clause | Subject | Implementation Action |
|---|---|---|
| Clause 8 | Data protection safeguards | Module-specific; verify all sub-clauses completed per selected module |
| Clause 9 | Use of sub-processors | Module 2/3: Document prior authorisation mechanism (specific or general); maintain sub-processor list; establish notification procedure for changes |
| Clause 10 | Data subject rights | Establish procedure for the importer to handle data subject requests; define response timelines (within 30 days per GDPR Art. 12(3)) |
| Clause 11 | Redress | Confirm independent dispute resolution body identified; verify importer will accept jurisdiction of competent courts |
| Clause 12 | Liability | Confirm liability allocation between parties; verify insurance or financial capacity to meet potential claims |
Section III — Local Laws and Government Access
| Clause | Subject | Implementation Action |
|---|---|---|
| Clause 14 | Local laws affecting compliance | Document the Transfer Impact Assessment results; identify specific laws in the importer's jurisdiction that may impinge on SCC protections |
| Clause 15 | Government access obligations | Importer must notify exporter of government access requests (unless legally prohibited); importer must challenge disproportionate requests; importer must provide transparency report |
Section IV — Final Provisions
| Clause | Subject | Implementation Action |
|---|---|---|
| Clause 16 | Non-compliance and termination | Establish escalation procedure: notification → 30-day cure period → suspension → termination; data return or deletion upon termination |
| Clause 17 | Governing law | Select law of the EU Member State of the exporter (Germany, for Athena Global Logistics) |
| Clause 18 | Choice of forum and jurisdiction | Select courts of the EU Member State of the exporter (Berlin, Germany) |
SCC Execution and Record-Keeping
- Version control: Maintain a register of all executed SCCs with version numbers, execution dates, parties, and selected modules.
- Periodic review: Review all executed SCCs at least annually or upon any material change in processing, importer jurisdiction law, or sub-processor arrangements.
- Regulatory updates: Monitor EDPB guidance and European Commission updates for any revision to the SCC instrument or supplementary guidance.
- Integration with TIA: Each SCC must reference the corresponding Transfer Impact Assessment documenting the assessment of the importer's jurisdiction under Clause 14.
- Supervisory authority cooperation: Maintain readiness to provide all SCC documentation to the competent supervisory authority upon request under Art. 46(2)(c) and Art. 58(1).