International data transfers: SCCs and the EU-US Data Privacy Framework

By the Privacyboard teamPublished 27 October 2026Updated 4 November 20265 min read

Short answer

Sending personal data outside the EEA is only allowed with a transfer tool: an adequacy decision, such as the EU-US Data Privacy Framework for certified US companies, or safeguards like Standard Contractual Clauses. For each vendor, find where it processes data, which tool covers it, and record it in your policy and register.

Most small businesses use at least one tool whose servers or staff are outside Europe: an American email platform, a support tool, an analytics service. Under the GDPR that is a transfer to a country outside the European Economic Area (EEA), and it needs a legal tool. This guide explains the options, where the EU-US Data Privacy Framework fits, and how to check your own vendors.

#What counts as a transfer?

Chapter V of the GDPR applies when personal data is sent to, or made accessible from, a country outside the EEA. It covers storing data on a server there and also remote access, for example a vendor's support team in another country viewing your customer records. The question is not where your company is, but where the data goes.

#The three main routes

#1. An adequacy decision (Article 45)

The European Commission can decide that a country, territory or sector ensures an adequate level of protection. Data can then flow with no extra paperwork. Countries with adequacy decisions include, among others, the United Kingdom, Switzerland, Japan and South Korea. Canada's decision covers organisations subject to its federal privacy law for commercial activities.

#2. Appropriate safeguards (Article 46)

When there is no adequacy decision, you can use safeguards. The one small businesses meet most is the Standard Contractual Clauses (SCCs), model contract terms adopted by the Commission in 2021 (Implementing Decision (EU) 2021/914) in four modules, depending on who is sending and who is receiving: controller to controller, controller to processor, processor to processor and processor to controller. Large vendors build them into their DPA, so accepting the DPA often puts them in place. Other safeguards, such as binding corporate rules, are mostly for large groups.

#3. Derogations (Article 49)

Specific exceptions, for example explicit consent to a one-off transfer or what is necessary to perform a contract. They are narrow, are not meant for routine transfers and should not be your plan for a vendor you use every day.

#The EU-US Data Privacy Framework

The Commission adopted an adequacy decision for the United States on 10 July 2023. It applies to US companies that self-certify to the Data Privacy Framework (DPF) and appear on the public list at dataprivacyframework.gov. For a certified vendor, you can rely on the framework instead of SCCs for the data covered by its certification.

Two practical points:

Check the list. Certification is per company, can lapse and may cover only part of the data, for example not HR data. Look the vendor up and note the date.
Understand the risk. Two earlier US frameworks, Safe Harbor and Privacy Shield, were struck down by the Court of Justice in 2015 and 2020 (the Schrems judgments). The DPF has been challenged too: the EU General Court dismissed the challenge in Latombe v Commission (case T-553/23) on 3 September 2025, the applicant appealed to the Court of Justice (case C-703/25 P), and that appeal was still pending when this was written. The framework remains valid until a court or the Commission says otherwise, but it is wise to know which vendors have SCCs as a fallback.

#What "after Schrems II" means for SCCs

In Schrems II (case C-311/18, July 2020), the Court said that using SCCs requires you to check whether the destination country's law lets authorities access the data in a way that undermines the clauses, and to add supplementary measures where needed. In practice this is a transfer impact assessment. For a small business using a major vendor, a short written assessment, relying on the vendor's published one and on the Commission's adequacy findings for the US, is usually proportionate. The EDPB's recommendations on supplementary measures explain what to look at, such as encryption with keys you control.

#How to check your vendors

List the vendors that handle personal data, from your register of processing.
Find where each processes data. The vendor's DPA, sub-processor list or help centre usually says. Many offer an EU region you can choose in your account.
Identify the tool that covers each transfer: an adequacy decision, DPF certification, or SCCs in the DPA.
Prefer an EU region when it is offered and equivalent. It removes the question for the main storage, although support access can still count.
Record the result for each vendor: the region, the tool and the date you checked.
Say it in your privacy policy. Article 13(1)(f) requires you to tell people about transfers and the safeguards. See what to include in a privacy policy.

#What to do if you are unsure

If you cannot find a vendor's region, ask its support in writing and keep the answer. If a vendor offers no transfer tool for a transfer you depend on, plan a switch. A vendor's own page is the best evidence, and a statement that you cannot verify should be marked "to confirm" rather than assumed.

#FAQ

Yes, with a valid transfer tool. For US vendors that is usually the Data Privacy Framework for certified companies, or Standard Contractual Clauses.

#Do I need SCCs if the vendor is certified under the DPF?

No, the certification covers the transfer within its scope. Many vendors include SCCs as a fallback anyway.

#Is the Data Privacy Framework still valid?

The Commission's adequacy decision remains in force, and a challenge to it was dismissed by the General Court in September 2025. An appeal was pending at the Court of Justice when this article was written, so check the current status before you rely on it exclusively.

#Does hosting in the EU avoid the issue?

For the stored data, yes. But if a vendor outside the EEA can access the data, for example support staff, that remote access can still be a transfer.

#Do I have to tell people about transfers?

Yes. Your privacy policy has to mention transfers outside the EEA and the safeguards used.

#What about the UK and Switzerland?

Both have adequacy decisions from the European Commission, so transfers to them are allowed without extra safeguards. They also run their own regimes for data flowing the other way.

#Sources

Privacyboard is a guidance tool, not legal advice. This article explains general rules in plain language and was accurate on the date above; laws and guidance change. For an unusual situation, ask a qualified professional. Spotted a mistake? Write to antoine@unmake.io.