Standard Contractual Clauses (SCCs) for the Data Act

What do the standard contractual clauses contain?

While the Data Act essentially specifies “what” is to be achieved, the new SCCs now provide more detail on “how” these requirements can be implemented in practice. By publishing them, the European Commission is fulfilling the mandate under Article 41 Data Act to provide standard contractual clauses, including for cloud computing contracts.

At the same time, with the SCCs the Commission aims to make the core principles enshrined in the Data Act — data accessibility, fairness and interoperability — tangible and applicable in contractual terms. This is intended to promote competition in the cloud sector and reduce technological dependencies on individual providers.

By creating clear, balanced and reusable contractual frameworks, the SCCs also strengthen trust in European cloud services and make an important contribution to the development of an open, secure and competitive data space in the EU.

The clauses are voluntary and drafted in such a way that they reflect the requirements of the Data Act while also being fair and balanced. They are modular in structure, complement one another, but may also be used individually and adapted to specific contracts. The SCCs apply to all data processing services, in particular IaaS, PaaS and SaaS.

Ready-made clause modules are available for:

• Switching & Exit: switching and exit (Annex VI),
• Termination: termination of the contract (Annex VI),
• Security & Business Continuity: security and business continuity (Annex VIII),
• Non-Dispersion, central documentation: avoiding scattered contractual documentation (Annex IX),
• Liability: liability (Annex X),
• Non-Amendment: prohibition of unilateral contractual amendments (Annex XI).

The SCCs address several detailed questions that the Data Act leaves open, such as:

• specific timelines for switching and exit (Annex VI),
• a phase model with defined timelines, termination period and transition period (Annex VI),
• a practical allocation of roles and tasks between the customer, the original provider and the future provider (Annex VI),
• templates for liability caps and risk assessment (Annex X).

Providers that use the SCCs as guidance can reduce the risk of infringing key Data Act obligations. It should be noted that obligations arising under the GDPR must be regulated separately in the contract. They are not implemented in the standard contractual clauses for the Data Act.

In addition, there may be further sector-specific regulation for data processing services, for example in the financial, healthcare, energy or public sector.

Cloud switching under the Data Act

The Data Act provisions on cloud switching concern what are known as data processing services. Under Article 2 No. 8 DA, these are, in simplified terms, digital services that enable a customer to access, via a network, a shared pool of configurable, scalable and elastic computing resources.

This typically includes standard cloud services such as IaaS, PaaS and SaaS, but also newer variations such as Storage-as-a-Service and Database-as-a-Service. The central aim of the cloud-switching rules is to facilitate switching between different data processing services in order to prevent a so-called “lock-in effect”. To this end, the Data Act provides for a number of obligations on providers vis-à-vis their customers in order to remove obstacles to switching cloud providers. These include in particular:

Removal of switching obstacles, Article 23 Data Act

1. Information obligations, for example regarding the switching procedure, Articles 26 and 28 DA
2. Abolition of switching charges, Article 29 DA
3. Technical assistance, Article 30 DA
4. Consideration and cooperation, Article 27 DA

For cloud users, this means above all that fees, termination barriers or format restrictions must no longer impede switching providers in future. Providers, in turn, must establish not only contractual but also technical and organisational processes to ensure the smooth migration of data, workloads and metadata.

Conclusion

Despite the new standard contractual clauses, qualified legal advice remains indispensable. Although the SCCs provide valuable guidance and facilitate implementation of the Data Act, they cannot cover all individual or sector-specific particularities.

Further complex issues that the SCCs do not fully resolve — for example interfaces with the GDPR, allocation of liability or international data flows — require legal assessment on a case-by-case basis. The GDPR may also become relevant in this context. Only targeted advice can ensure that cloud contracts are not only legally compliant, but also optimally structured from a commercial and operational perspective.

Now is a sensible time to review existing cloud contracts and provider strategies in detail. Interdisciplinary teams from legal, IT and compliance should jointly analyse how the new SCC modules can be integrated into existing structures in a practical way. Companies that rely on sound legal advice in this process not only reduce legal risks, but also strengthen their strategic position in the digital single market.