SCC
Standard Contractual Clauses (SCCs) are contract templates adopted by the European Commission that allow personal data to be transferred to a country without an adequacy decision, by binding the recipient to GDPR-level obligations.Chapter V of the GDPR only allows transfers of personal data outside the EEA with appropriate safeguards. The most common safeguard is the set of SCCs adopted by Commission Implementing Decision (EU) 2021/914 of 4 June 2021, with four modules (controller to controller, controller to processor, processor to processor, processor to controller) and a docking clause for new parties. The UK uses its own International Data Transfer Agreement or an addendum to the EU clauses; Switzerland accepts the EU clauses with adaptations.
Since the Court of Justice's Schrems II judgment (C-311/18, 16 July 2020), signing the clauses is not enough: the exporter must assess whether the law of the destination country undermines them and add supplementary measures if needed. For transfers to the United States, companies certified under the EU-US Data Privacy Framework can rely on the adequacy decision of 10 July 2023 instead.
Cookies and tags make transfers routine. Google Analytics, Meta Pixel, embedded fonts, maps and videos send visitor data to servers abroad, and each vendor's data processing terms incorporate the SCCs or rely on the Data Privacy Framework. A cookie policy should say which providers transfer data where, and on what basis, and the privacy policy should list the safeguards. The question is the same one raised by Google Fonts and the GDPR: a request to a US server is a transfer.