Appropriate Safeguards and Derogations
For third countries, transfers need an appropriate safeguard. The two most common are SCCs (the most widely used) and BCRs (for intra-group transfers, after DPA certification). Derogations are narrow exceptions like explicit consent.
How this supports CIPP/US study
Use this lesson to identify the disclosure, workplace or cross-border rule that changes the result in a fact pattern. Continue with the CIPP/US study plan.
For third countries (no adequacy, outside the EEA), an appropriate safeguard is required. Two key mechanisms enable lawful EU-to-U.S. transfers:
- Standard contractual clauses (SCCs): a company contractually promises to comply with EU law and submit to DPA supervision - in practice the most common legal basis for transfers
- Binding corporate rules (BCRs): let a multinational transfer data among affiliated entities after certification of its practices by a DPA
A Derogation is the EU term for an exception. Derogations allow a transfer on explicit consent or where necessary for: a contract with the subject (and the transfer is occasional), a contract in the subject's interest with a third party (occasional), important public-interest reasons, legal claims (occasional), or vital interests. Regulators read these narrowly - only so far as strictly necessary.
Key terms - quick answers
What is “Standard contractual clauses (SCCs)”?
What is “Binding corporate rules (BCRs)”?
What is “Derogation”?
Sources and study method
This independent lesson uses active recall, spaced retrieval and scenario practice. Read the full study method.