Introduction
A typical software business sends personal data abroad all day long without noticing. Analytics tools, email platforms, cloud hosting, customer support systems and AI assistants all move data around the world. Many of these providers are American, and every time personal data about European customers travels to them, European law asks the same question: what legal tool makes this trip allowed?
The good news is that you can use American tools under the General Data Protection Regulation, usually called the GDPR. The condition is that for each tool, you must be able to name the legal mechanism that covers the transfer, and back it up with paperwork. This article explains what counts as a transfer, why earlier legal frameworks for EU and US data flows collapsed, how the current framework works and why you should not depend on it alone, what standard contract clauses require of you, and a simple checklist for reviewing your own tools.
What Counts as a Transfer
The rules sit in Chapter V of the GDPR. Personal data may only leave the European Economic Area, if its protection travels with it. There are three routes. The first is an adequacy decision, where the European Commission formally decides that a country protects data well enough. The second is appropriate safeguards, which for most businesses means standard contractual clauses, a set of ready-made contract terms approved by the Commission. The third is a short list of exceptions for occasional, unusual situations.
Many founders think a transfer only happens when data is stored on a server outside Europe. It is much wider than that. If an engineer in the United States can log in and see your European database, that access counts as a transfer. If a tool hosted in Europe sends usage data back to its American parent company, that is a transfer. If your provider uses its own sub-provider in the United States, your data follows it, and that is a transfer too. A normal software company makes transfers like these thousands of times a day.
The consequences are real. Meta received a 1.2 billion euro fine, among the largest ever issued under the GDPR, and it was about transfers rather than a data breach or spam. The Dutch data protection authority fined Uber 290 million euros because driver data was sent to the United States for a period without any valid transfer mechanism in place, a decision Uber has challenged. And the EU’s General Court even ordered the European Commission itself to pay damages to a visitor, because a login button on one of its own websites sent the visitor’s IP address to the United States. That ruling was appealed, but it shows how seriously courts can treat even small transfers.
Why Two Earlier Frameworks Collapsed
To judge the current framework, it helps to understand why the previous two failed.
The first, called Safe Harbor, allowed American companies to promise that they would protect European data. The EU’s highest court, the Court of Justice, struck it down in a case brought by Austrian privacy activist Max Schrems. Its replacement, called Privacy Shield, followed the same basic idea, and the same court struck it down as well, again in a case brought by Schrems. The reason both times was the same. United States surveillance law could reach European data more widely than EU fundamental rights allow, and Europeans had no effective way to challenge that.
The second judgment, known as Schrems II, still shapes daily practice. It confirmed that standard contractual clauses remain valid, but only if the business using them checks that the clauses actually work in the country the data is going to. It also led to real enforcement against ordinary businesses. Several European data protection authorities decided that common setups of Google Analytics were unlawful, because contract terms on paper could not solve a surveillance problem in practice.
The Current Framework, and Why You Should Not Rely on It Alone
To answer the court’s concerns, the United States issued an executive order limiting intelligence activities to what is necessary and proportionate, and created a Data Protection Review Court where Europeans can seek a remedy. On that basis, the European Commission adopted an adequacy decision for the EU-US Data Privacy Framework.
Read the detail carefully, because the framework does not cover the United States as a whole. It covers only American companies that have certified themselves under it with the US Department of Commerce, appear on the official public list, and renew their certification every year. So the useful question is never whether the United States is safe now. The useful question is whether this specific provider is on the list, whether its certification is active, and whether it covers the type of data you are sending. The list is public and easy to search, so check it for each provider and keep a dated screenshot as evidence.
You should also be realistic about how long any framework will last. This one has already been challenged. A first challenge before the EU’s General Court failed, and an appeal was then brought before the Court of Justice, the same court that struck down the two earlier frameworks. The protections also rest on a US executive order rather than a law passed by Congress, which means a future administration could change them. None of this stops you from using the framework while it is in force. It does mean you should confirm it is still in force before relying on it, and that you should always have a second mechanism ready in case it falls.
Standard Contractual Clauses and the Assessment Behind Them
That second mechanism is usually the standard contractual clauses. They are model contracts approved by the Commission, and the current version is split into four modules depending on the roles of the parties, for example one business passing data to another business, or a business passing data to a service provider acting on its instructions. In practice they are normally built into your provider’s data processing agreement, and you accept them when you sign.
Signing is not the end of it. Before relying on the clauses, you must carry out a transfer impact assessment. This is a written review of what data goes to which country, what the authorities there can demand, and whether you need extra protection such as strong encryption, pseudonymisation, or encryption keys held in Europe. The clauses themselves, contain a promise from you that this assessment has been done and documented. If a regulator asks for it and nothing exists, your own contract becomes evidence against you.
For the United States specifically, the assessment is simpler than it used to be, because the safeguards in the executive order also protect data transferred under standard contractual clauses, not only data transferred under the framework. You can rely on the findings the Commission itself made about those safeguards.
Two warnings. The exceptions, such as a person’s explicit consent or a transfer that is necessary to perform a contract, are intended for occasional situations, not for running your everyday systems. And being a small business is not an exemption. Having no valid transfer mechanism is exactly the situation that led to the Uber fine.
A Checklist for Your Own Tools
The practical work comes down to four steps.
- Map. List every tool that handles personal data, then open each provider’s list of sub-providers, because your data goes wherever their providers go.
- Classify. For each transfer, identify the route. Staying inside the European Economic Area needs nothing further. A country with an adequacy decision is covered. A US provider actively certified under the framework is covered for as long as the framework stands. Anything else needs standard contractual clauses plus a documented assessment.
- Document. Sign data processing agreements with every provider, use the current version of the clauses where needed, keep your assessments on file, and make sure your privacy policy and your records of processing mention the transfers, because telling people about transfers is a separate legal duty.
- Reduce. Choose European data regions where providers offer them, but understand the limit. A European region with American support staff who can access it still involves a transfer, and US law can require American companies to hand over data they control even when it is stored in Europe. This is why some providers offer separate “sovereign” cloud services. For most small and medium sized businesses, the answer is not fear but good paperwork combined with sensible architecture.
AI tools deserve special attention. Check whether your plan uses your data to train the provider’s models, whether you have a signed data processing agreement, and where the data is stored. A business account with a signed agreement is very different from a free personal account, and pasting customer data into the free version is a transfer that nobody has covered.
Conclusion
In summary, personal data may only leave the European Economic Area through one of three routes: an adequacy decision, appropriate safeguards such as standard contractual clauses, or narrow exceptions for occasional cases. Transfers include hosting, remote access, usage data sent home and sub-providers, and the fines for getting this wrong can be very large. Two earlier EU-US frameworks were struck down by the Court of Justice, and the current Data Privacy Framework has also been challenged, so use it while it is in force but never build your compliance on it alone. It only covers providers with an active certification for your type of data, so check the list and keep a record. Standard contractual clauses remain the everyday tool, and they come with a transfer impact assessment that you promise, in the clauses themselves, has been done.
The frameworks for EU and US data flows have changed more than once, and they may change again. What has stayed constant is the question a regulator will ask: which legal mechanism covers this transfer, and where is the evidence?
