What are standard contractual clauses and when are they needed?
By Advisorn · updated on 25 October 2026 · Art. 16 para. 2 FADP, Art. 10 Data Protection Ordinance, Art. 46 GDPR
In short
Standard contractual clauses (SCC) are a standard contract in which the recipient abroad undertakes to protect the data. They are needed to transfer data to a State without adequate protection (Art. 16 para. 2 let. d FADP). The FDPIC recognises the European Commission's clauses of 2021, with the adjustments for Swiss law, and their use need not be notified.
How they are used
- choose the right module (for example controller to processor);
- fill in the annexes: parties, processing, security measures, sub-processors;
- for Switzerland add the adjustments: the FDPIC as the competent authority, Swiss law, the term "Member State" read as including Switzerland;
- assess whether the law of the destination country, for example on access by the authorities, prevents compliance with them, and add measures where needed.
When they are not needed
They are not needed for the States with adequate protection listed in Annex 1 to the Data Protection Ordinance, which include all States of the EU and the EEA, nor for US companies certified under the Swiss-U.S. Data Privacy Framework.
Related questions
Useful templates
General information, not advice on your case: for your case the text of the law prevails. For a question about your case there is Advisorn's consulting.