On 22 January 2026, the EDPB published a procedure document setting out how supervisory authorities should cooperate when authorising ad-hoc contractual clauses under Article 46(3)(a) GDPR and when supporting the adoption of new Standard Contractual Clauses under Article 46(2)(d).

This is a procedural development, but it has practical significance. While SCCs adopted by the European Commission are widely used, Article 46 also allows controllers and processors to propose bespoke clauses (ad-hoc clauses) that provide appropriate safeguards — subject to supervisory authority authorisation. Likewise, supervisory authorities can adopt SCCs that may ultimately be approved by the European Commission. The new EDPB procedure aims to ensure that such processes are coordinated and consistent across Member States.

For organisations, the message is that transfer contracting is not a “free-for-all”. Bespoke clauses can be part of an organisation’s toolkit, but they will be evaluated through a structured pathway. The EDPB’s procedure describes lead roles and cooperation phases, reinforcing that national authorisations in cross-border contexts should not drift into divergent standards.

This matters most for organisations with unusual transfer scenarios — for example, complex processor chains, industry-specific requirements, or legacy contractual structures where the Commission’s SCCs do not map cleanly. It also matters for large vendors that want contractual standardisation but operate across many jurisdictions: a clearer cooperation framework reduces uncertainty around how authorisations will be treated.

Acompli perspective: The smartest approach is to treat transfer contracting as part of a wider transfer governance model. SCCs and ad-hoc clauses are not, on their own, sufficient; they are the legal shell around your technical and organisational measures. If your organisation can maintain an accurate map of transfers, vendors, access risks, and supplementary controls, then contractual change becomes manageable rather than disruptive.