Will you sign appropriate GDPR Standard Contractual Clauses (SCCs) with the institution?

This question is asking whether your company is willing to sign Standard Contractual Clauses (SCCs) to comply with the EU's General Data Protection Regulation (GDPR) when transferring personal data outside the European Economic Area (EEA). What it means: Standard Contractual Clauses are pre-approved contractual terms and conditions that both data exporters (the institution) and data importers (your company) sign to ensure that personal data transferred outside the EEA receives adequate protection in line with GDPR requirements. SCCs are a legal mechanism to make cross-border data transfers compliant with GDPR. Why it's being asked: This question appears in security assessments because: 1. If your service processes EU citizens' data and stores or processes it outside the EEA, there must be a legal mechanism in place for this transfer 2. After the invalidation of the EU-US Privacy Shield in 2020 (Schrems II decision), SCCs became even more important as a transfer mechanism 3. Institutions need to ensure their vendors are willing to commit to these legal protections to avoid potential GDPR violations and fines 4. The institution has a legal obligation to ensure appropriate safeguards are in place when transferring data internationally How to best answer it: You should indicate whether your company is willing to sign SCCs. If you are, state this clearly. If you have already implemented SCCs with other clients, mention this. If you don't transfer data outside the EEA or don't process EU personal data at all, explain this context. If you use alternative compliance mechanisms (like Binding Corporate Rules), explain those instead. Be specific about your company's approach to GDPR compliance regarding international data transfers.