SCCs work by embedding specific contractual obligations into agreements between the data exporter (e.g., an EU-based company) and the data importer (e.g., a non-EU-based ESP). These obligations include provisions related to data protection, such as ensuring data security, respecting data subject rights, and reporting data breaches. By incorporating SCCs into their contracts, companies can legally transfer personal data across borders while maintaining compliance with the EU's General Data Protection Regulation (GDPR).