The legal framework is necessary. Treating it as sufficient is where the governance gap opens.
Why This Matters Now
Standard Contractual Clauses are the primary mechanism through which European organizations transfer personal data to third countries without an adequacy decision. Since the invalidation of Privacy Shield and the introduction of the new SCCs in 2021, executing updated SCCs has been the central activity in most organizations' post-Schrems II compliance programs. Legal teams have reviewed and updated agreements, DPAs have been refreshed, and transfer impact assessments have been completed.
The investment in SCC compliance is real and necessary. The governance gap is that SCC compliance addresses the legal framework for data transfers and does not directly address the operational question of what is actually happening to data at the transfer destination, how data is being used, whether it is being protected in ways consistent with the SCC obligations, and whether the third country's legal environment poses risks that the SCC clauses cannot practically mitigate.
An SCC is a contract. A contract tells you what parties have committed to. It does not tell you what parties are actually doing. The gap between contractual commitment and operational reality is the SCC governance gap.
The Governance Problem Beneath the Surface
SCCs create obligations on the data importer: to process data only for specified purposes, to implement appropriate security measures, to notify the data exporter of legal orders that conflict with SCC obligations, and to support data subjects' rights. These are meaningful obligations. They are also contractual obligations whose enforcement depends on the data exporter's ability to monitor compliance, investigate breaches, and exercise audit rights.
In practice, most organizations that have executed SCCs have not built the operational monitoring capability to verify that SCC obligations are being met on an ongoing basis. Audit rights are rarely exercised. Third-country legal environment assessments are performed at execution time and not continuously updated. Data flows at the transfer destination are governed by the importer's own practices, which the exporter cannot directly observe.
SCCs shift the legal risk framework for cross-border transfers. They do not shift operational responsibility for what happens to data to a party the exporter can monitor and control. The legal risk is managed. The operational risk remains with the exporter while the data is at the destination.
What This Actually Means in Enterprise Practice
Transfer Impact Assessments Are Point-in-Time
The post-Schrems II transfer impact assessment framework requires organizations to assess whether the third country's legal environment allows effective protection of transferred data. This assessment is performed when SCCs are executed. Third-country legal environments change: new surveillance legislation is enacted, enforcement practices shift, adequacy decisions are challenged. A TIA performed two years ago may not accurately reflect the current legal environment at the transfer destination.
Audit Rights Are Rarely Exercised
SCCs give data exporters the right to audit data importer compliance. In practice, these rights are rarely exercised by most organizations. The operational cost of conducting meaningful audits of data importers, many of which are large global technology companies, is high. The practical ability of smaller data exporters to audit major SaaS providers or cloud platforms is limited. Audit rights that exist contractually but are never exercised provide governance assurance in theory that has not been validated in practice.
An audit right you have never exercised is a governance mechanism you have documented but not used. The SCC obligation is contractual. The assurance that the obligation is being met requires operational verification that unexercised audit rights do not provide.
SCC Obligations Cannot Cover All Transfer Scenarios
SCCs were designed for defined, identified transfers between specified parties. Modern enterprise data architectures create transfer scenarios that SCCs were not designed to govern: subprocessor chains where data flows through multiple parties to a non-EU destination, API-based transfers that occur in real time outside any specific transfer documentation, and vendor-to-vendor transfers that occur without the original data exporter's direct involvement. The SCC framework covers what it was designed to cover. The architectures that enterprise technology creates extend beyond that scope.
Government Access Risk Is Continuous
A central concern in the Schrems II decision was the risk of government access to personal data in third countries with surveillance regimes that do not provide equivalent protection to EU data subjects. SCCs include obligations on data importers to notify exporters of government access requests that conflict with SCC obligations. The practical effectiveness of this notification obligation depends on the importer being able to make such notifications, the legal environment permitting them to do so, and the exporter having a meaningful response capability. These conditions vary significantly by jurisdiction and by circumstances.
How Different Teams See This: Where They All Miss
SCC governance is structured around execution events: executing the SCCs, completing the TIA, documenting the transfer. Ongoing operational compliance monitoring of SCC obligations requires continuous governance activity that execution-focused programs do not sustain.
Framework Control Reference
The specific control obligations most relevant to this topic across primary frameworks. Use these references in governance discussions, vendor assessments, and audit responses.
These controls share a common requirement: the obligation is active, not declarative. Documenting alignment is not the same as demonstrating it.
The Enterprise Reality Gap
The enterprise SCC governance reality gap is between the legal transfer compliance organizations document and the operational transfer compliance they monitor. The documentation gap was largely closed through the post-Schrems II SCC update programs most organizations completed between 2021 and 2023. The operational monitoring gap remains open in most organizations.
Closing the operational monitoring gap requires continuous TIA currency maintenance for high-risk transfers, periodic audit right exercises for significant data importers, monitoring of data importer security posture against SCC obligations, and tracking of third-country legal developments that may affect transfer adequacy. These are ongoing operational governance activities that most SCC compliance programs were not designed to sustain.
The post-Schrems II SCC update program closed the legal documentation gap. The operational monitoring program that would close the compliance assurance gap has not been built in most organizations.
Enterprise Scenario: The Transfer That Was Legal and Unmonitored
The SCCs are valid. The legal basis for the transfer is documented. The operational reality at the transfer destination has changed in ways that may or may not be consistent with the SCC obligations, and the data exporter has no mechanism to detect it because the governance program that was built addressed execution and not ongoing monitoring.
Industry Signal
The EDPB's updated guidance on SCCs and transfer impact assessments has increasingly emphasized the ongoing nature of transfer compliance obligations. The position that executing SCCs satisfies Article 46 obligations as a permanent state has been challenged in several supervisory authority interactions, with authorities requiring organizations to demonstrate ongoing adequacy of their transfer mechanisms rather than just their initial compliance documentation. The governance expectation is shifting from execution to sustained compliance.
The regulatory direction on SCC compliance is from documentation to demonstration. Organizations that built compliance programs around SCC execution and TIA completion are equipped for yesterday's standard. The standard is moving toward ongoing operational compliance verification.
Enabling Capabilities
- Transfer monitoring programs: Defined processes for ongoing monitoring of third-country legal environment changes that may affect transfer adequacy assessments.
- TPRM platforms: Including Verisq AI, BitSight, and similar solutions that provide ongoing vendor compliance monitoring beyond initial assessment.
- Audit right exercise programs: Structured processes for exercising contractual audit rights for significant data importers on a risk-based schedule.
- Legal intelligence services: Monitoring services for third-country legal developments affecting data transfer adequacy.
- Data flow monitoring: Technical monitoring of actual data flows to transfer destinations to verify that transfers occur as documented and that data is handled as specified.
A Practical Starting Point
Audit your most significant transfers for operational compliance currency. For your five highest-risk data transfers, assess: when was the TIA last updated, when was the data importer's security posture last assessed, when was the audit right last exercised, and have there been material changes at the importer since execution that affect their SCC obligations.
The answers reveal the ongoing monitoring gap. Build a monitoring schedule for the highest-risk transfers that addresses TIA currency, importer compliance assessment, and audit right exercise on a defined cadence.
SCC governance is not finished when the SCCs are signed. It is ongoing work that execution-focused compliance programs do not sustain. Build the monitoring program that sustains it.
Questions Leaders Should Be Asking
- For our highest-risk data transfers, when were the transfer impact assessments last updated, and have we assessed whether third-country legal environments have changed since then?
- When did we last exercise audit rights against a significant data importer, and what would we find if we exercised them today?
- Do we have a process for detecting material changes at data importers, such as acquisitions, management changes, or regulatory sanctions, that may affect their SCC compliance?
- What is our process for updating transfer documentation when new data flows to existing importers are established through new integrations?
- How would we detect if a data importer were subject to a third-country government access order, and what would our response process be?
What to Require From Vendors
Ask directly:
"Beyond the SCC execution, what ongoing compliance evidence do you provide to demonstrate that you continue to meet your SCC obligations, specifically including third-country government access requests you have received and how you handled them, and what is your notification process if your compliance with SCC obligations becomes impaired?"
Expect as evidence:
- Transparency reports or equivalent documentation covering government access requests
- Current security certifications with scope documentation applicable to SCC obligations
- Defined notification process for SCC obligation impairment events
- Audit right exercise process with defined scope and response commitments
A vendor who provides SCC documentation without ongoing compliance evidence has given you the contract and not the compliance. The contract creates the obligation. The evidence demonstrates it is being met.
Demonstrating Diligence
- Documentation: TIA records with update history; SCC execution records with scope documentation; audit right exercise records for significant importers.
- Process: TIA update trigger process for third-country legal changes; defined audit right exercise schedule; importer change monitoring and assessment.
- Technical evidence: Data flow monitoring outputs for transfer destinations; importer security posture assessment records; government access request notification records.
SCC diligence is demonstrated through ongoing operational compliance monitoring, not through documentation of initial execution. Show that you have continued to govern the transfer relationship after the SCCs were signed.
Closing Perspective
Standard Contractual Clauses are a genuine and necessary governance tool for cross-border data transfers. They provide the legal framework that EU data protection law requires for transfers to third countries. The organizations that have invested in updating their SCCs, completing transfer impact assessments, and building comprehensive transfer documentation have done necessary and valuable governance work.
The limitation of SCC compliance programs built around execution is that they treat transfer governance as a documentation milestone rather than an ongoing operational discipline. The legal framework is in place. The operational monitoring that would give the legal framework practical meaning in ongoing transfer relationships has not been built.
Building that monitoring capability is the next phase of transfer governance maturity. It is the phase that the regulatory direction is requiring and that the organizations who built strong execution programs need to build next.
SCCs commit parties to compliance. Ongoing monitoring demonstrates it. Both are required. Most programs have built the first.
Enterprise practitioner perspective. Not legal advice. Part of the Deep Trust Governance Series by Verisq. Get the free weekly Breach Digest.