Standard Contractual Clauses are the EU-approved contract template that lets organizations transfer personal data from the EEA to a country that does not have an adequacy decision. They are the fallback mechanism for the bulk of cross-border data flows. The 2021 modular SCCs replaced the older 2010 versions and are the only set still valid for new arrangements.
The SCCs come in four modules, picked based on the relationship between the data exporter and importer. Module 1 covers controller-to-controller transfers. Module 2 covers controller-to-processor. Module 3 covers processor-to-processor (this is where the sub-processor chain shows up). Module 4 covers processor-to-controller, which is rarer but real. Most SaaS DPAs incorporate Module 2 and Module 3 by reference, with the relevant annexes filled in.
Schrems II is the case that matters here. The EU Court of Justice held that signing the SCCs is necessary but not sufficient. The exporter has to assess whether the law of the importer's country provides essentially equivalent protection, and if not, layer in supplementary measures. That assessment is the Transfer Impact Assessment. The UK has a parallel mechanism, the International Data Transfer Addendum, that piggybacks on the EU SCCs.
In contract drafting, the SCCs are an annex to the DPA, not the DPA itself. The annexes spell out the parties, the nature of the processing, the categories of data, the security measures, and the sub-processors. Get those annexes right and the rest of the SCCs do their work. Get them wrong and you have an unenforceable transfer mechanism.