Friday, July 2, 2021 The European Commission adopted new versions of the Standard Contractual Clauses (SCCs) on June 4, 2021. The new SCCs finally replace the original SCCs adopted under the 1998 European Data Protection Directive (DPD) and did not completely meet the requirements of the General Data Protection Regulation (GDPR) passed in 2016. For example, the scope of the DPD only applied to data controllers in the European Union (EU) or European Economic Area (EEA), and the original SCCs assumed that the controller was always in the EU or the EEA and was the entity exporting the personal data. However, the scope of the GDPR is significantly broader than the DPD. It may apply to organizations physically located outside of the EU or EEA when they offer their goods and services to individuals located in the EU or EEA. Controllers located outside of the EU or EEA that used the original SCCs to facilitate transfers to processors located within the EU or EEA were required to sign off as a “data exporter,” while data processors were left to be classified as “data importers.” The new SCCs seek to fix this by applying to a more diverse set of situations, accounting for the reality of processors and controllers located within or outside of the EU or EEA.