The importance of Standard Contractual Clauses in the Data Processing Agreement

This article examines the crucial role of Standard Contractual Clauses (SCCs) in shaping Data Processing Agreements (DPAs) within the framework of the General Data Protection Regulation (GDPR). It begins by examining the evolving relationship between data controllers and processors, focusing on the contractual obligations established under Article 28 GDPR. Particular attention is given to the formal and substantive requirements that DPAs must fulfill, including liability distribution and compliance mechanisms. The article then analyzes the SCCs adopted by the European Commission and by national data protection authorities, specifically Denmark and Croatia, assessing their effectiveness in addressing regulatory ambiguities. While SCCs serve as important tools for ensuring GDPR compliance and harmonizing data protection practices, the study reveals significant shortcoming, especially regarding the regulation of liability and the risk of imbalance between contracting parties. The Danish model, although pioneering, delegates too much responsibility to the parties themselves, while the Croatian model, despite offering more specific guidance on liability, ultimately refrains from going beyond the wording of the GDPR. In light of these findings, the article argues for a renewed institutional effort to develop more comprehensive and prescriptive SCCs, in order to clarify the more ambiguous aspects of the GDPR and to promote greater fairness and legal certainty in Data Processing Agreements throughout the European Union.