Data that leaves Europe, tracked vendor by vendor.
Personal data may leave the EEA only with a legal tool: adequacy, the Data Privacy Framework or standard contractual clauses. Privacyboard finds your vendors’ transfers, records each tool and prefills the assessments.
Free to set up · No credit card · Checked 12 November 2026
In short
- Applies to
- Anyone using a provider outside the EEA
- Tools
- Adequacy, DPF, SCCs
- Largest fine
- EUR 1.2 billion, Meta, 2023
- In Privacyboard
- Free to flag, TIAs on Pro
What Chapter V asks, and where it lives
Pick a duty to see the screen that handles it.
What the law asks
Every transfer counts, subprocessors included.
In Privacyboard
Each vendor’s region from its documents, transfers flagged.
Every plan
Show all 5 duties as a list
Art. 44Know which data leavesEvery plan
What the law asks: Every transfer counts, subprocessors included.
In Privacyboard: Each vendor’s region from its documents, transfers flagged.
Art. 45–46Rely on a transfer toolEvery plan
What the law asks: Adequacy, the DPF or standard contractual clauses.
In Privacyboard: A default tool for the company, overridable per vendor.
DPFCheck certificationsEvery plan
What the law asks: The DPF only covers US companies on the official list.
In Privacyboard: Certifications checked daily, with an email when one changes. Alerts on Pro.
EDPB 01/2020Assess the destinationPro
What the law asks: For SCCs, check the destination’s laws: the TIA.
In Privacyboard: Six EDPB steps, prefilled, reused per country.
Art. 13(1)(f)Tell people and clientsEvery plan
What the law asks: Your policy and DPA must list transfers.
In Privacyboard: Both list them, from the same records. DPA on Pro.
The numbers to know
fine against Meta for US transfers, 2023
in an EDPB transfer assessment
the Data Privacy Framework is adopted
The DPF was upheld in September 2025; an appeal is pending. Keep SCCs as a fallback.
How the rules got here
Schrems II
Privacy Shield struck down.
New SCCs
And the EDPB recommendations.
DPF
Adequacy for certified US companies.
Latombe
DPF upheld, appeal pending.
Brazil
Recognised as adequate.
What Privacyboard covers, and what it does not
Covered
- Each vendor’s region, transfers flagged
- The transfer tool of each transfer
- DPF certifications checked daily
- Transfer impact assessments on Pro
- Transfers in your policy and DPA
Not covered
- Signing SCCs: they are in each vendor’s agreement
- Auditing where a vendor really stores data
- Transfers by your own teams, added by hand
Privacyboard is a guidance tool, not legal advice.
Your first hour
- 1
Confirm regions
Each vendor shows where its data is.
- 2
Set transfer tools
A default, and exceptions.
- 3
Start the TIAs needed
Prefilled on Pro.
- 4
Validate policy and DPA
Both list your transfers.
Go online for free. Grow when you need to.
Free puts you online. Pro adds requests, monitoring and your team; Business, security questionnaires and only your brand.
Free
$0 forever
No card, no time limit
For getting compliant and going online on your own.
Start for freeKey features:
- Privacy and cookie policies
- Vendor and processing registers
- Requests and breaches tracked
- Impact assessment screening
- AI Act screening
- Privacy center on privacyboard.io
- Cookie banner on 1 domain
- 1 person
- And 1 more on the pricing page
No card needed
ProRecommended
$20 per month
Billed $240 a year Save $48
For founders who want to be compliant in a few clicks and stay that way.
Start with ProEverything in Free, plus:
- DPA for your clients
- Vendor monitoring
- Reminders for documents and reviews
- Request form and replies
- Your own domain
- Banner on 3 domains, every choice logged
- Weekly site scan
- Complete DPIAs and TIAs
- AI assistant connector
- 2 people
- And 1 more on the pricing page
Cancel any time
Business
$109 per month
Billed $1,308 a year Save $240
For the person in charge of privacy: every detail in order, a team with roles, and proof for audits and customers.
Start with BusinessEverything in Pro, plus:
- Up to 50 people, with roles
- PDF and Excel exports
- Signed agreements on vendors
- Activity log kept 3 years
- Security questionnaires answered for you
- No Privacyboard mention
- Center in English and French
- Evidence pack in one click
- Banner on 10 domains, daily scan
- Two-step verification required
- And 3 more on the pricing page
Bank transfer on request
Questions, answered.
Is a DPF-certified US vendor enough?
Yes, for the data its certification covers, while it stays on the list.
When do I need a TIA?
For transfers under SCCs or binding corporate rules. Not under adequacy or the DPF.
Which countries are adequate?
Among others the UK, Switzerland, Japan, South Korea, Canada, Israel, New Zealand, Argentina, Uruguay and Brazil.
Is a US cloud with EU servers a transfer?
Not by itself, but remote access or subprocessors abroad can be.
Official sources
- GDPR Chapter V, EUR-Lex
- European Commission, adequacy decisions
- European Commission, EU-US data transfers
- Irish DPC, Meta decision
- EDPB Recommendations 01/2020
Checked on 12 November 2026. Laws and guidance change: read the official text before you rely on a figure.
Read more
Guides on the blog
- How the Privacyboard vendor catalog is verified: every page opened and read6 min read
- Vendor privacy due diligence: a 12-point checklist before you sign9 min read
- International data transfers: SCCs and the EU-US Data Privacy Framework5 min read
- Is Google Analytics allowed in the EU? What regulators have said9 min read
- Data processing agreement (DPA): when you need one and what it must contain5 min read
In the documentation
Other regulations
Features to start with
Impact assessments
Screen each activity for a DPIA, and assess transfers outside the EEA.
Learn moreVendor list
Document every tool that handles personal data, prefilled for 1,290+ common tools.
Learn moreData processing agreement
A data processing agreement drafted from your answers, when you process data for clients.
Learn more
