Standard Contractual Clauses (SCCs)
European Commission-approved contract terms that organizations use to provide safeguards for transferring personal data to a country without an adequacy decision. Per the Schrems II doctrine, SCCs alone are insufficient if the destination country's own government-access laws undermine the protections the clauses promise.
Defined in 3 GAGE programs, which carry 3 distinct definitions of it. The wording above is taught in Certified China AI Regulatory Professional (CCARP).
How each discipline defines it
The same term does different work depending on who is using it. These are the definitions as each program teaches them, unedited.
European Commission-approved contract terms that organizations use to provide safeguards for transferring personal data to a country without an adequacy decision. Per the Schrems II doctrine, SCCs alone are insufficient if the destination country's own government-access laws undermine the protections the clauses promise.
Pre-approved contract terms that provide a lawful basis for transferring personal data out of a jurisdiction (used under the GDPR and, in a filed form, under China's PIPL) where no adequacy decision exists. They are a common "ship with modifications" condition for a feature that moves data across a border.
EU-approved contract templates providing a legal basis for transferring personal data to countries lacking an adequacy decision, requiring a Transfer Impact Assessment.
Where it is taught
The exact lessons this term appears in. The first module of every program is free with a free account.
- Privacy and Data Rights in AI Systems · Ethical and Responsible AI and Operational Governance, Certified AI Practitioner: Workplace Foundations
- The cross-border decision: where your organization may ship its AI feature, defended with citations · The World's Rulebooks, Certified AI Governance Professional (CAIGP)
- Conflicting Requirements · China, EU, US: The Comparative Playbook, Certified China AI Regulatory Professional (CCARP)
Where it shows up at work
A definition is where Standard Contractual Clauses (SCCs) starts. The lessons above teach it inside the competencies below, which are what job descriptions ask for and what the GAGE credential records. Every link here is drawn from the same careers map that builds a role's readiness check.
Applies GDPR, CCPA and sector rules to training data, inference, automated decisions, lawful basis, individual rights and cross-border transfer.
One lesson on this page teach it as a primary outcome.
Compares the EU AI Act, NIST AI RMF, ISO/IEC 42001 and sector rules by intent and control objective, and says where they do not overlap.
One lesson on this page teach it as a primary outcome.
Builds minimization, purpose limitation, de-identification, consent and retention into an AI system before launch, with tests that prove it.
One lesson on this page teach it as a primary outcome.
Roles that hire for it
Each role page shows the full competency set, what the seat decides, and a readiness check against your own evidence.
- Chief Privacy Officer, AI privacy editionneeds it at depth
- AI Compliance Managerneeds it at depth · 2 open postings this week
- Privacy Analystneeds working knowledge
- AI Regulatory Counselneeds it at depth · 14 open postings this week
- Senior AI Compliance Analystneeds it at depth
- AI Privacy Engineerneeds it at depth · 6 open postings this week
How job descriptions say it
Postings rarely use the textbook word. These are the phrases the careers map reads as asking for the competencies above.
Where the frameworks place it: GDPR; CCPA/CPRA; EU AI Act Article 27; EU AI Act.
One interview question about it
Apply a privacy law you know to a model trained on customer records. Where is the legal basis, and where is the risk?
Asked of candidates for privacy law applied to ai. Answering it in your own words is exactly how a GAGE topic is passed, and the credential records the pass where an employer can check it.
If you come from another field
Some backgrounds already carry this competency, and the readiness check gives credit for it.
- Privacy and data protection carries it as work you can show: Privacy assessments and lawful-basis records are your work product.
- Legal and paralegal work carries it as a claim to back up: Privacy and consumer law are usually within reach.
- A law degree (JD, LLB or LLM), no AI work yet carries it as a claim to back up: Privacy and data protection law are usually a course, not yet a file.
Terms it appears with
Not an alphabetical neighbourhood: these are the terms taught in the same lessons, ranked by how often they appear together.