Explainer · reading a DPA
What are standard contractual clauses (SCCs)?
Contract terms written by the European Commission. Sign them, and a transfer of personal data out of the EU can meet the GDPR’s rules.
They are for a company sending personal data from the EU to a recipient outside the GDPR’s reach.
The law is quoted from the official text on the date shown. Vendor clauses carry a fingerprint (SHA-256 hash) of the dated copy we kept.
What they are
What do the clauses do?
The Commission's decision says what they do, and the GDPR names them as one of the ways to make a transfer lawful.
Commission Implementing Decision (EU) 2021/914, Article 1(1)
The standard contractual clauses set out in the Annex are considered to provide appropriate safeguards within the meaning of Article 46(1) and (2)(c) of Regulation (EU) 2016/679 for the transfer by a controller or processor of personal data processed subject to that Regulation (data exporter) to a controller or (sub-)processor whose processing of the data is not subject to that Regulation (data importer).
GDPR Article 46(2)(c)
The appropriate safeguards referred to in paragraph 1 may be provided for, without requiring any specific authorisation from a supervisory authority, by: … (c) standard data protection clauses adopted by the Commission in accordance with the examination procedure referred to in Article 93(2);
Modules
There are four modules, one for each pair of roles.
The parties pick the module that matches who is the controller and who is the processor. A company using an AI vendor for its own data is usually in Module Two; if it processes that data for business customers, Module Three.
MODULE ONE
Transfer controller to controller
MODULE TWO
Transfer controller to processor
Usually yours, with an AI vendor.
MODULE THREE
Transfer processor to processor
Yours if you process your customers’ data and pass it to an AI vendor.
MODULE FOUR
Transfer processor to controller
Module titles as the Annex to Decision (EU) 2021/914 gives them, read September 30, 2026.
Sub-processors
Clause 9 leaves a blank, and vendors fill it in.
Clause 9 governs sub-processors. The parties choose one of two options, and both leave the period blank.
Standard contractual clauses, Clause 9(a), Module Two, Option 1
OPTION 1: SPECIFIC PRIOR AUTHORISATION The data importer shall not sub-contract any of its processing activities performed on behalf of the data exporter under these Clauses to a sub-processor without the data exporter’s prior specific written authorisation. The data importer shall submit the request for specific authorisation at least [Specify time period] prior to the engagement of the sub-processor, together with the information necessary to enable the data exporter to decide on the authorisation.
Standard contractual clauses, Clause 9(a), Module Two, Option 2
OPTION 2: GENERAL WRITTEN AUTHORISATION The data importer has the data exporter’s general authorisation for the engagement of sub-processor(s) from an agreed list. The data importer shall specifically inform the data exporter in writing of any intended changes to that list through the addition or replacement of sub-processors at least [Specify time period] in advance, thereby giving the data exporter sufficient time to be able to object to such changes prior to the engagement of the sub-processor(s).
[Specify time period] is where some vendors’ notice periods come from: Redis, Nebius and HireVue fill it in. Others set the period in their own data processing agreement (DPA) terms.
HireVue
30days' notice before a change
The data importer shall specifically inform the data exporter in writing of any intended changes to that list through the addition or replacement of sub-processors at least 30 days in advance, thereby giving the data exporter sufficient time to be able to object to such changes prior to the engagement of the sub-processor(s).
read September 13, 2026 · fingerprint 97ba1f7ae902
OpenAI
30days to object
Customer may object to the use of such additional Sub-processor within 30 days of receiving notice of the change by following the instructions set forth in the Sub-Processor List or by contacting [email address on the vendor's page].
read November 14, 2026 · fingerprint 140ecaafd530
We quote the period from 81 AI vendors’ clauses on notice windows.
Common questions.
- What are standard contractual clauses?
- Contract terms adopted by the European Commission that, when used, provide appropriate safeguards for transferring personal data to a recipient whose processing is not subject to the GDPR. The current set is in Commission Implementing Decision (EU) 2021/914 of June 4, 2021.
- What are the four SCC modules?
- Module One: controller to controller. Module Two: controller to processor. Module Three: processor to processor. Module Four: processor to controller. The parties use the module that matches their roles.
- What do SCCs say about sub-processors?
- Clause 9 gives two options: specific prior authorization, where the importer asks before each sub-processor, and general written authorization, where it works from an agreed list and must inform the exporter of changes "at least [Specify time period] in advance".
- Who fills in the time period in Clause 9?
- The parties do. The template leaves it blank. Some vendors fill it in where their DPA adopts the clauses; others set their own period in their DPA terms. Xither quotes the period for each AI vendor clause it holds on its notice windows page.
- Where does the GDPR allow standard contractual clauses?
- Article 46(2)(c) lists standard data protection clauses adopted by the Commission as one of the appropriate safeguards for transfers, available without specific authorization from a supervisory authority.
Not legal advice.
This page quotes the clauses and published agreements on the dates shown. The version your contract incorporates, and how it was completed, governs.
Xither Staff Writer · reviewed September 30, 2026. Vendor clauses and counts are generated from the record when the page is served.
Hear the morning we read a change to your vendor’s sub-processor list or DPA.
Name the AI vendors in your product. When a page you watch changes a fact, you get the lines that moved and the date any window runs out.
Try it free for 14 daysNo card. Nothing to cancel.