International Data Transfers After the Data Privacy Framework

International data transfers after the Data Privacy Framework

International data transfers from Germany to countries outside the European Economic Area are subject to Chapter V of the General Data Protection Regulation (GDPR). A transfer is lawful only if the destination country has an adequacy decision (Article 45), if appropriate safeguards such as standard contractual clauses (SCCs) or binding corporate rules are in place (Article 46), or if a narrow derogation applies (Article 49).

For the United States, the key instrument since 10 July 2023 is the EU-US Data Privacy Framework (DPF): the European Commission's adequacy decision (Implementing Decision (EU) 2023/1795) allows transfers to US organisations that have self-certified under the framework. In September 2025 the General Court upheld the decision against a challenge, and the framework continues to apply in November 2026.

International data transfers are not limited to obvious cases such as sending files to a foreign customer. They occur whenever personal data are made accessible to a recipient outside the EEA — through cloud services, software support, group IT, outsourced call centres, recruiting platforms, analytics tools and AI services. In a typical German company, dozens of such flows exist.

For German companies, the practical questions are which mechanism applies to each data flow, whether a transfer impact assessment is needed, how to handle US cloud providers and group companies, and what to do if the DPF were to be invalidated as its predecessors were in Schrems I (2015) and Schrems II (2020).

The Data Privacy Framework and the Latombe judgment

The DPF is based on US commitments made in Executive Order 14086 of 7 October 2022, which strengthened safeguards for signals intelligence activities, and on a new redress mechanism, including the Data Protection Review Court (DPRC). US organisations self-certify with the US Department of Commerce, commit to the DPF principles and are listed publicly; transfers to listed organisations within the scope of their certification need no further safeguards.

A French member of parliament challenged the adequacy decision before the General Court. In its judgment of 3 September 2025 in Latombe v Commission, T-553/23, the General Court dismissed the action.

According to the Court's press release, it found that the DPRC's judges benefit from safeguards ensuring their independence — they can be dismissed only by the Attorney General and only for cause — and that Schrems II does not require prior independent authorisation of bulk collection, provided there is at least ex post judicial review, which the DPRC provides. The Court also emphasised that the Commission must continuously monitor the US legal framework and can suspend, amend or repeal the decision if it changes. An appeal to the Court of Justice has been lodged, so the final word has not yet been spoken.

Standard contractual clauses and transfer impact assessments

Where no adequacy decision covers a transfer, most companies use the Commission's standard contractual clauses of 2021, which offer modules for controller-to-controller, controller-to-processor, processor-to-processor and processor-to-controller transfers. After Schrems II, exporters must assess whether the law and practice of the destination country allow the importer to comply with the clauses — the transfer impact assessment (TIA) — and adopt supplementary measures where needed, such as encryption with keys held in the EU or pseudonymisation.

For transfers to US recipients that are not DPF-certified, the DPF assessment of US surveillance law and redress is also relevant for TIAs, because Executive Order 14086 and the DPRC apply to all transfers to the US regardless of the transfer tool. Many companies therefore rely on the Commission's findings when documenting TIAs for SCC-based US transfers. The assessment should nevertheless consider the specific recipient: the type of data, whether the importer is subject to particular surveillance laws, and the contractual and technical safeguards it offers.

Cloud and SaaS providers

Most international data transfers today happen through cloud and software providers. Key questions for German customers include:

• Where are data stored and processed, including for support, maintenance and backups?
• Which affiliates and sub-processors in third countries have access, and under which tool?
• Is the provider (or its US parent) DPF-certified, and does the certification cover the relevant data, including HR data?
• How does the provider handle access requests from foreign authorities, and what transparency reports and challenge commitments does it offer?
• What technical measures — encryption, key management, EU data boundaries — are available?

Remote access from a third country, for example by a support engineer, is a transfer even if the data remain on servers in the EU. Data processing agreements under Article 28 GDPR must be aligned with the transfer clauses, and customers should check that their audit rights and notification rights cover sub-processors abroad. Where providers offer EU data boundary services, the contractual commitments and their exceptions should be read carefully.

HR data, onward transfers and certification scope

HR data deserve particular attention. US organisations must expressly include human resources data in their DPF certification if they want to receive employee data under the framework; many certifications cover only non-HR data. German employers sending employee data to a US parent for global HR systems, compensation or talent management must therefore check the scope of the parent's certification or use SCCs. Works council co-determination rights over technical systems capable of monitoring employees apply in parallel; see our page on works councils.

Onward transfers are another frequent gap. A DPF-certified US recipient may pass data on to third parties only under the framework's onward transfer principle, which requires contracts ensuring equivalent protection. For SCC-based transfers, the clauses themselves regulate onward transfers. Exporters should ask recipients for their sub-processor and onward-transfer lists and update them regularly.

Contingency planning: what if the DPF falls?

Given the history of Safe Harbor and Privacy Shield, prudent companies plan for a possible invalidation. Practical steps include keeping SCCs in place as a fallback with US providers (many providers include them in their terms), maintaining TIAs, assessing which data could be localised in the EU and documenting supplementary measures. If the framework were invalidated, transfers relying solely on it would lose their legal basis immediately, while SCC-based transfers would need reassessment but could continue where the TIA supports them.

Transfers to other countries

Adequacy decisions also exist for countries such as the United Kingdom, Switzerland, Japan, South Korea, Canada (commercial organisations), Israel and others, and the Commission periodically reviews and adds to the list. For China, India and many other important markets, transfers usually rely on SCCs and TIAs, sometimes combined with local data export rules of the destination country. Groups with operations worldwide should consider binding corporate rules for intra-group transfers; see our insight on intra-group data sharing and transfers.

Non-personal data and the Data Act

International data transfers of non-personal data are not governed by the GDPR, but the Data Act adds a separate layer for providers of data processing services. Under the Data Act, cloud and other data processing service providers must take adequate technical, organisational and legal measures to prevent international governmental access to non-personal data held in the EU where such access would conflict with EU or national law, and they must publish information about their safeguards. For German companies using cloud services for industrial and operational data, this provides additional assurance and contractual leverage. See our insight on cloud switching under the Data Act.

Documentation and accountability

The accountability principle requires exporters to be able to demonstrate compliance. In practice, this means a record of processing activities that identifies third-country transfers, a transfer register with tools and assessments, copies of signed SCCs and certification checks, TIAs reviewed periodically, and evidence of supplementary measures. Authorities and auditors often focus on whether TIAs are genuinely tailored to the transfer or merely generic templates. A short, specific assessment per category of transfer is usually more convincing than a long generic document.

Illustration

Illustration: a hypothetical German Mittelstand manufacturer uses a US-based CRM platform, a US cloud provider for its ERP system and an Indian IT service provider for second-level support. The CRM provider is DPF-certified, including for HR data, so transfers rely on the adequacy decision. The cloud provider's EU subsidiary hosts the data, but US engineers can access it for support; the provider's terms include SCCs and encryption with customer-managed keys, documented in a TIA. The Indian service provider signs the processor-to-processor module of the SCCs with the German company's processor, supported by a TIA and access controls.

Enforcement and risks

Unlawful international data transfers are subject to the higher tier of GDPR fines (Article 83(5)(c)) and can lead to suspension orders. German authorities have examined transfers to US providers in website tracking, cloud services and HR systems. Data subjects can claim damages for unlawful transfers, and competitors or consumer associations occasionally challenge transfers in civil proceedings. The risk is highest where transfers are systematic, involve sensitive data and lack any documented assessment. See our insight on GDPR fines in Germany.

AI services and international data transfers

Generative AI services add a new category of transfers. Prompts, documents and data entered into AI tools may be processed by providers outside the EU, stored for abuse monitoring or used for model improvement unless excluded by contract. Before rolling out AI tools, companies should identify the provider's processing locations, transfer tool and retention settings, and configure enterprise versions accordingly. See our page on the AI Act.

How TRW & Co helps with international data transfers

We advise companies on international data transfers from Germany and the EU: mapping data flows, choosing transfer tools, drafting SCCs and data processing agreements, preparing TIAs, negotiating with cloud and SaaS providers, and developing binding corporate rules. We also prepare contingency plans for changes to the DPF and represent clients in supervisory authority proceedings concerning transfers. See our page on GDPR and data protection and our US desk, or contact us.