The UK’s independent authority set up to uphold information rights in the public interest, promoting openness by public bodies and data privacy for individuals.

Am I controller or a processor?

A controller makes the decision about how the data is processed. A processor completes the action on behalf of the controller. 

Who can use this template?

Use this template to build a contract using SCCs to transfer personal data from an EEA based controller to your UK based organisation or business, which is working as a processor. It aims to cover common issues and is designed to help micro, small and medium sized businesses use the SCCs in straightforward cases where you won't need professional advice.

What if I don't know the answer?

Of course, any guidance cannot cover all eventualities, or complex or unusual cases. If you don't fit the questions, you aren't sure about your answer, or your answers indicate that there are more complex issues, you may need to read our detailed guidance on international transfers or seek professional advice. We have flagged this and linked to more detailed guidance where we think relevant.

What if I am receiving data on an urgent basis?

If you are receiving personal data for a medical emergency or another compelling urgent reason where a one-off or occasional transfer of personal data is required, the sender may be able to rely on one of the exceptions and you will not need to use the SCCs.

How do I use this template?

Once you click ‘Start now’ you will be asked eleven multiple choice questions. It should take no more than ten minutes to answer them.

To help you answer the questions, before you start, it is worth thinking about your data processing activity, including:

  • the nature of the data you're transferring;
  • the organisations involved;
  • your current security measures; and
  • any additional information that applies.

At the end of the questionnaire, press ‘Submit’ to create a draft contract, which will contain all the clauses you need to include, any optional clauses you selected, plus all the other information you provided about the data transfer.

Once I’ve created the draft contract, what should I do next?

  • Download the draft contract as a Word document, using the pink download button.
  • Complete the remaining details where indicated.
  • Do not alter the clauses (please note any references to the Directive are correct and should not be changed to GDPR).
  • Consider seeking your own legal advice before signing.
  • Both parties must sign all the signature boxes. There are different ways to sign agreements. Here are some suggestions:
    • If the sender and receiver are both present, both can sign two copies.
    • One party (it doesn’t matter which) signs two copies and then posts them to the other party to sign both as well.
    • One party (it doesn’t matter which) signs one copy and then scans the signed version and emails it to the other party to sign.
    • Once both parties have signed, you should enter the date at the top of the contract. The standard contractual clauses are now a binding contract. 
    • Each party keeps one signed copy of the contract for their records. A scanned version is sufficient.

Start now