Cross-Border Data Transfers: What’s Still Legal

Data moves at the speed of light. The laws governing where it is allowed to land move at the speed of international courts.

For years, executing a gdpr cross border data transfer was a quiet, standard paperwork exercise. Then the framework collapsed.

• July 2020: The Court of Justice of the European Union (CJEU) invalidates Privacy Shield in the Schrems II decision.
• July 2023: The EU-US Data Privacy Framework (DPF) is adopted, bringing a fragile stability.
• Today: The landscape is steadier, but not settled. And organizations still relying on pre-2020 frameworks are operating on borrowed time.

Here is exactly where things stand: what works, what doesn’t, and what you actually need to do.

Why a GDPR Cross Border Data Transfer Needs a Mechanism at All

GDPR Chapter V restricts transfers of personal data outside the European Economic Area (EEA) unless specific conditions are met.

The principle is simple: personal data of EEA residents should keep its armor on, wherever it flows. When data moves to a jurisdiction where that protection cannot be guaranteed by default, a legal mechanism must bridge the gap.

This affects almost everyone

If you have European users, you are almost certainly making international transfers. The cloud feels borderless, but infrastructure runs in physical buildings.

• Your cloud provider’s servers are in the US.
• Your customer support platform may process data in the US.
• Your HR systems may store employee data in US datacenters.

Each one is an international transfer. Each one requires a legal basis.

The mechanisms available

🇺🇸 The EU-US Data Privacy Framework: Where It Stands

The European Commission adopted the EU-US Data Privacy Framework in July 2023, replacing the invalidated Privacy Shield.

It rests on Executive Order 14086, which introduced new safeguards on US government access to EU residents’ data, including a new redress mechanism.

How it works

The DPF is a valid transfer mechanism only when the US recipient holds an active eu us data privacy framework certification.

• Certification is maintained by the US Department of Commerce.
• You can verify any company’s status at dataprivacyframework.gov.

Before you rely on it

1. Confirm your US vendor passes a current dpf certification check.
2. Confirm their certification covers the specific type of processing you are engaging them for.
3. Document your reliance on the DPF in your records of processing and relevant data processing agreements.

The legal challenges

The DPF has already been tested in court, and it survived round one.

• In September 2025, the EU’s General Court dismissed a challenge to the DPF brought by French MEP Philippe Latombe, upholding the framework.
• Latombe appealed to the CJEU, and that appeal is still pending.

That matters, because the CJEU is the exact court that struck down both previous frameworks (Safe Harbor and Privacy Shield).

The smart move: a backup plan

A third invalidation is still possible. That is why smart organizations using the DPF also implement SCCs as a parallel mechanism. If the framework falls, they do not have to trigger emergency remediation.

Standard Contractual Clauses: Still the Workhorse

Standard Contractual Clauses (SCCs) remain the load-bearing walls of global data flows, covering transfers to countries without adequacy decisions.

Make sure you are on the current version

The Commission updated the SCCs in June 2021. Organizations still using the old SCCs should have transitioned by December 2022.

Using outdated SCC versions is not a technicality; it is a compliance gap.

Pick the right module

The 2021 SCCs use a modular structure covering four scenarios:

You must use the correct module for your specific transfer relationship.

SCCs alone often aren’t enough

Schrems II requires you to assess whether the destination country’s laws undermine the practical effectiveness of the SCCs.

This assessment is called a Transfer Impact Assessment (TIA). GDPR’s text doesn’t name it explicitly, but the 2021 SCCs themselves require the parties to warrant they have assessed the destination country’s laws. European DPAs expect it, especially for countries with broad government access to data, including the US.

What a TIA examines

• The legal framework of the destination country
• The likelihood that the specific data transferred would be subject to government access
• Whether the data processing agreement scc provisions provide effective protection in that context

For most commercial B2B transfers to US SaaS vendors, TIAs typically conclude that the risk is low and SCCs provide adequate protection.

Whatever you conclude: document the analysis.

Adequacy Decisions: The Simplest Mechanism

For transfers to countries with a European Commission adequacy decision, no additional mechanism is needed. The adequacy decision is the transfer mechanism.

Current adequacy decisions cover:

Andorra, Argentina, Brazil, Canada (commercial organizations), the European Patent Organisation, the Faroe Islands, Guernsey, Israel, the Isle of Man, Japan, Jersey, New Zealand, the Republic of Korea, Switzerland, the United Kingdom, Uruguay, and the United States (for organizations certified under the Data Privacy Framework).

Keep checking

For transfers to any of these destinations:

• Document your reliance on the adequacy decision.
• Confirm it hasn’t been suspended or withdrawn.

The Commission reviews adequacy decisions periodically. New ones are added, and political events can affect their status. Check the Commission’s official list for the latest.

🇬🇧 The UK: A Separate Consideration After Brexit

EU → UK transfers

After Brexit, the UK is no longer part of the EEA. It is a third country with an EU adequacy decision. So transfers from the EU to the UK rely on that adequacy decision.

That decision was renewed in December 2025, and now runs until December 2031.

UK → elsewhere transfers

Transfers from the UK to other countries are governed by UK GDPR, which runs its own transfer regime, using tools such as the international data transfer agreement uk (IDTA) and the UK Addendum to the EU SCCs.

What that means in practice

• UK organizations transferring data to the EU don’t need an additional mechanism. The UK recognizes the EU as adequate.
• UK organizations transferring data to the US or other non-adequate countries must comply with uk gdpr international transfers requirements, not the EU’s.

The Vendor Inventory Connection

Every vendor in your processing chain located outside the EEA (or UK) represents a transfer that needs a legal mechanism.

What your vendor inventory should record

For each processor:

• Country of establishment and datacenter locations
• The transfer mechanism relied upon
• When that mechanism was last verified

Review at least annually

An annual review of your transfer mechanisms is minimum due diligence, because reality changes:

• Adequacy decisions can be withdrawn.
• DPF certifications must be renewed annually.
• SCC versions can be superseded.

A mechanism that was perfectly valid when you signed the contract may not be valid today if nobody has maintained it.

A top audit finding

This is one of the most frequently found gaps in privacy audits: transfers that were properly authorized years ago, under mechanisms that have since changed, where the organization simply hasn’t kept pace.

Data moves fast. Your transfer mechanisms need to keep up.

Ready to Simplify Compliance?

Compliance is not a static state. It is an ongoing alignment with reality.

If you want a cleaner way to run this playbook, explore how Regodit can help you operationalize GRC without slowing your roadmap. Schedule a call or a short demo, and see how the evidence builds itself while your team ships.