Can you use a US cloud provider under GDPR, and what does it take?
You can use a US cloud provider under GDPR when a valid Chapter V transfer tool covers the flow. For a recipient on the Data Privacy Framework List, that tool is the adequacy route created by Commission Implementing Decision (EU) 2023/1795 of 10 July 2023. For any other US recipient, it is standard contractual clauses under Commission Implementing Decision (EU) 2021/914, supported by a documented transfer assessment. The GDPR requires no certificate for either route. The controller decides which tool applies, owns the record of that decision, and remains accountable for it. An implementation partner can prepare the configuration, contracts and evidence, but only an independent auditor, assessor or certification body issues reports or certificates, and a DPF listing is a self-certification by the provider, not a regulator's approval of your deployment.
The adequacy route is not permanently settled. An appeal against the General Court's judgment in Case T-553/23 Latombe v Commission was lodged on 31 October 2025 as Case C-703/25 P, and it was published in the Official Journal on 22 December 2025. The Commission's adequacy page still lists US DPF participants as adequate in October 2026. Confirm the current status on the Commission's adequacy page before each decision, and record which version of the position you relied on. Check also whether the provider's DPF entry covers the services and data categories you will use, because the listing is organization-specific. Where the provider is not listed, or where you want a fallback if the decision changes, plan the SCC route in parallel rather than waiting for the outcome.
The answer varies by provider, data type and access pattern, so treat it as a per-flow decision. A provider's storage in an EU region does not by itself remove the transfer question if support staff or administrators outside the EEA can read data in the clear, and an EU-hosted service can still be subject to US law with extraterritorial reach. Ask the provider in writing which entity contracts with you, whether it is listed under the DPF for your services, which sub-processors and support locations are involved, and how it handles government access requests. Then run the transfer assessment for SCC-based flows and document the result. Encryption helps only where the key and the plaintext stay outside the reach of the importer, which is a design question to settle with your architects before signing.
DPF, SCCs or both: which transfer route fits your provider
When a US recipient appears on the Data Privacy Framework List maintained by the US Department of Commerce, Commission Implementing Decision (EU) 2023/1795 finds that the United States ensures an adequate level of protection for transfers to that organization. The adequacy decision is the tool that applies, so standard contractual clauses are not needed for that transfer. The controller still has to confirm the listing itself and keep it under review.
- Check the List directly: Search the Data Privacy Framework List yourself rather than relying on a provider's marketing or a copy in a contract. Record the date you checked and the entity name exactly as it appears.
- Confirm the scope of the listing: Verify that the listed entity covers the services you buy and the data categories you send, since a listing can be limited to certain services.
- Review sub-processors: DPF does not remove the need to review each provider's sub-processors, including any that receive data outside the framework.
- Monitor the legal position: An appeal against the General Court judgment in Case T-553/23 was lodged on 31 October 2025 (Case C-703/25 P). Keep a record of how the framework's status is tracked and be ready to switch tools if it changes.
Before relying on the listing, confirm the entity name, services and sub-processor list in writing with the provider.
A US recipient that is not on the DPF List is outside the adequacy decision, so the transfer needs another Chapter V tool. In most cases that tool is the 2021 standard contractual clauses under Commission Implementing Decision (EU) 2021/914, combined with a documented transfer impact assessment. The controller must confirm that the clauses are in place and that the importer can actually comply with them in the US legal context.
- Execute the right module: Select the SCC module that matches the roles of exporter and importer, such as controller to processor or processor to processor, and sign it before the transfer starts.
- Clause 14 warranty: The parties warrant that they have no reason to believe US laws and practices, including public authority access, prevent the importer from meeting its obligations. This warranty needs a documented assessment behind it.
- Clause 15 obligations: The importer must review the legality of public authority disclosure requests and challenge them where there are reasonable grounds. Ask the provider how it handles such requests and how it notifies you.
- Supplementary measures: Where the assessment finds gaps, identify the technical or contractual measures that close them. Some transfers cannot be made safe by technical means alone.
- Plan for the appeal: The pending appeal means the adequacy route could change. A fallback SCC arrangement reduces disruption if the framework's status moves.
Ask the provider for its signed clauses, its transfer impact assessment support and a written commitment on handling government requests.
A US-headquartered provider that stores your data in an EU region does not remove the transfer question by location alone. The EDPB's Guidelines 05/2021 (Example 12) state that using an EU processor subject to third-country law with extraterritorial effect is not itself a transfer, but complying with a third-country authority request would be one. Where the US parent or its staff can access the data from the US, the access itself is a transfer and needs a tool.
- Establish who can access the data: Determine whether support, administration or the parent company can reach the data from outside the EEA, since that access may be a transfer.
- Apply a tool for remote access: If access from the US is possible, cover it with the DPF listing or SCCs, depending on the recipient's status.
- Address foreign authority requests: Under Article 48, a third-country order is enforceable in the EU only through an international agreement such as a mutual legal assistance treaty, without prejudice to other Chapter V grounds. Ask how the provider responds to such orders.
- Document the decision: Record the data flows, the access paths and the reason the EU region does or does not remove transfer work.
- Confirm the region and sub-processors: Verify the region commitments in the contract and the sub-processors that might process data outside the EEA.
If you cannot confirm where access originates, treat the arrangement as a transfer until the provider shows otherwise in writing.
What the transfer assessment must establish for a US provider
The transfer assessment has to establish one thing: whether the laws and practices of the United States, as they apply to this particular provider and this particular data, undermine the protection that the standard contractual clauses are meant to give. The controller owns this conclusion. The provider's marketing statements and its DPF listing do not replace it when the transfer relies on SCCs rather than the adequacy decision, and even where a provider is on the Data Privacy Framework List, the controller should still know which transfer tool covers each data flow. Under Clause 14 of the 2021 clauses, both parties warrant that they have no reason to believe local laws and public authority access practices prevent the importer from meeting its obligations. That warranty is only credible if the assessment has looked at the access powers that actually apply to the importer's category of data.
Clause 15 then makes the importer responsible for the day-to-day part of the test. The importer must review the legality of any public authority disclosure request and, where there are reasonable grounds to consider it unlawful, challenge it. The assessment should therefore record what the provider has committed to do when a request arrives: who reviews it, how the controller is told, what the provider's policy is on challenging requests, and how many requests it has received in the past, as far as it is permitted to disclose that. Confirm these commitments in the contract and in the provider's transparency documentation rather than relying on verbal assurances from sales or account teams.
Document the outcome as a written record that names the transfer, the tool relied on, the laws considered, the evidence reviewed, the conclusion and any supplementary measures. The EDPB Recommendations 01/2020 describe a step-by-step framework for choosing those measures, and the conclusion can be that no effective measure exists for a given flow. Do not present a favorable outcome as a given: if the assessment cannot support the transfer, the controller must suspend the flow, change the design or find another basis. Repeat the assessment when the provider changes its sub-processors, when US law or the adequacy position changes, or when a government request reveals new facts. Your DPO or privacy lead should own the file, and any outside reviewer should be engaged on the written scope.
How Article 48 and foreign authority requests change the contract
A US provider's EU hosting does not remove foreign authority risk, so the contract has to say what happens when a government asks for data. The points below are the commitments an organization should seek in writing before relying on the provider's transfer position.
Article 48 recognition limits
Article 48 says a third-country court judgment or administrative decision requiring disclosure is recognized or enforced only if it rests on an international agreement in force with the Union or a Member State, such as a mutual legal assistance treaty. Ask the provider to commit in writing that it will not disclose data on a foreign order without first confirming that such a basis applies, and that it will route requests through the channel the agreement provides.
Clause 15 review and challenge duty
Under Clause 15 of the 2021 standard contractual clauses, the importer must review the legality of public authority disclosure requests and challenge them where there are reasonable grounds. Ask the provider to describe its legal review process, who decides whether to challenge, and whether it will seek interim relief or take the matter to court. Clause 15 duties apply only where the SCCs are the transfer tool, so confirm which tool covers your data.
Notification to the controller
A provider that receives a foreign request should notify the controller before disclosure where the law allows it, and should disclose only the minimum data the request specifies. Put a notification deadline, the permitted exceptions and a record of each request in the processing terms. Ask the provider to confirm that gag orders limit only what it may say, not its duty to log the request internally.
Transparency reporting requests
Ask the provider for its policy on publishing aggregate counts of government requests, and whether it will supply request figures for your tenancy on demand. Clarify whether reports cover EU-hosted data separately from US-hosted data. Treat a provider that refuses all reporting as a gap in your transfer assessment rather than a neutral choice.
Instruction following and Article 28(10)
Under Article 28(10), a processor that determines purposes and means of processing beyond the controller's instructions is treated as a controller for that processing. EDPB Guidelines 05/2021 apply this to a processor that complies with a third-country request against the controller's instructions. Require a written commitment that the provider will act only on documented instructions, and that it will refuse a conflicting request unless legally compelled, in which case it must tell you.
Why EU-hosted services from a US provider still need review
Hosting data in the EU does not, on its own, settle the question for a US provider. The EDPB's Guidelines 05/2021 (Example 12) treat using an EU processor that is subject to third-country law with extraterritorial effect as not in itself a transfer. The same example makes clear that complying with a third-country authority request for the data would be a transfer, and that a processor which complies against the controller's instructions becomes a controller under Article 28(10). The exposure therefore sits in what a US authority could compel the provider to disclose, not in the server location alone.
The controller still has to assess that exposure. Ask the provider which entity employs the staff who can reach the production environment, which group companies hold administrative or support access, and whether any of those persons or systems sit under US jurisdiction. Then check whether the provider has a documented process for handling government requests, whether it commits to challenging unlawful ones, and how it will notify you. Record the answers as part of the transfer assessment, and confirm each point in writing with the provider, since the contract and its sub-processor list define what is actually in scope.
The full residency analysis, including when keeping data and administration inside the EEA removes transfer work, is covered in Does GDPR require EU data residency?. Treat the EU location as one input to the review, and document the access model alongside it. If your own team runs the platform on infrastructure you control, confirm which provider staff, if any, can reach the systems and the data at each layer.
How the provider decision and transfer file come together
The sequence turns a provider choice into a defensible file: one set of data flows, one documented legal basis for each transfer, a transfer assessment with its supplementary measures, and the records that show the controller knows where its data goes. Each phase produces an artifact that the next phase relies on, and the file is reopened when a trigger occurs. The schedule depends on the number of services in scope and on how fully the provider documents its own access practices.
Map data flows and provider roles
The controller, with its privacy and engineering leads, lists every system and service that receives personal data, including backups, logs, support tooling and monitoring. For each flow, record where data is stored, where it is processed, and which entity can access it in the clear. Confirm whether each provider acts as processor, sub-processor or independent controller for that flow. The output is a data flow inventory with a role and location against each line. Done means every flow has an owner and no service is left unassigned.
Confirm DPF status or sign SCCs
For each US recipient, check whether the organization is listed on the Data Privacy Framework List maintained by the US Department of Commerce. Where it is listed, record the entry and the date you checked it. Where it is not listed, or where the transfer goes to an entity outside the list, select the 2021 standard contractual clauses and sign the applicable modules with the importer. Ask the provider in writing which tool it relies on for each entity in the chain. The output is a file showing the Chapter V tool chosen for every transfer.
Complete the transfer assessment
Assess the law and practice of the destination country against the transfer in question, including the public authority access powers the provider could face. Ask the provider for its policy on government requests, its transparency reporting and its record of challenging disclosure demands, then test whether those answers hold for your data. Where the importer needs access to data in the clear and the assessment finds powers beyond what is necessary and proportionate, document why no supplementary measure would be effective. Where measures are available, such as encryption with keys held in the EEA, record the design and test that it works. The output is a signed assessment with a conclusion for each transfer and the measures attached.
Document supplementary measures and contract terms
Translate the assessment conclusions into contract and technical commitments. Confirm that the processing agreement includes instructions on government requests, the importer's duty to review and challenge unlawful requests under Clause 15, and notice to the controller where permitted. Record which technical measures are in place, who holds the keys, and what the provider cannot do without your instruction. Have legal counsel review the wording. The output is a contract set and a measures register that map each commitment to the transfer it supports.
Review sub-processors and onward transfers
Obtain the provider's current sub-processor list and the locations and roles of each entity. Check that each sub-processor is covered by the same transfer tool or an equivalent one, and that the provider notifies you of changes before they take effect. Include support and administration access from outside the EEA as a separate transfer, since remote access can count as a transfer even when no data is copied. The output is a sub-processor register with the Chapter V basis and the assessment reference for each entry.
Update the record of processing and privacy notices
Reflect the confirmed flows, roles and transfer tools in the Article 30 record of processing activities. Update the privacy notice so that it names the categories of recipients and states the transfer safeguards in place, including how individuals can obtain a copy of them. Align the retention and deletion settings in each provider with the schedule you documented. The output is a revised record and notice, with version dates and an owner for each change.
Set re-evaluation triggers and review dates
Define the events that reopen the file: changes to the DPF List or a court ruling affecting the adequacy decision, a new sub-processor or a change of location, a government access request or breach at the provider, material changes to the service, and changes in the destination country's law. Assign an owner to monitor each trigger and set a periodic review date that fits your risk appetite. The Commission's adequacy page and the EUR-Lex publications are the natural places to watch for changes in the adequacy position. The output is a monitoring procedure and a dated review log that shows when the file was last confirmed.
Who is paid for what when using a US cloud provider
This table shows who carries each cost of using a US-headquartered cloud or SaaS provider under GDPR, whether it is one-time or recurring, and what moves it up or down. No fee or duration figure is supplied for this page, so use the rows to structure itemized quotes and internal budget requests rather than as estimates. The main takeaway is that the largest variable cost is usually the transfer assessment and contract negotiation, not the technical work.
| Cost component | Who is paid or who does the work | One-time or recurring | What drives it up or down |
|---|---|---|---|
| Internal legal and privacy time | Your own DPO, privacy counsel and procurement staff | One-time for initial assessment, recurring for reviews | Number of providers, sub-processors and data categories in scope |
| Provider contract terms and negotiation | Your legal team, with the provider's standard terms or DPA | One-time for signing, recurring when terms change | Whether the provider accepts your SCCs or DPF reliance terms without redlines |
| Outside privacy counsel | External lawyers engaged for the transfer assessment and foreign authority request analysis | One-time for initial work, occasional for new legal developments | Scope of the assessment and whether the destination's law is contested |
| Implementation partner work on technical measures | Partner prepares configuration, key management, access controls and evidence, under a written scope | One-time build, recurring for upgrades and evidence refresh | Architecture choice, such as customer-managed keys or EEA-only administration, and the number of systems involved |
| DPF list monitoring and annual reassessment | Internal privacy team, sometimes supported by counsel | Recurring | Frequency of provider changes, litigation affecting the adequacy decision, and internal reporting needs |
| Contract change reviews | Your legal team, reviewing provider updates to terms, sub-processors and transfer locations | Recurring | How often the provider updates its DPA or adds sub-processors |
| External DPO or assessor review | Independent DPO service or auditor, which issues no GDPR certificate | Recurring or per engagement | Whether you need independent review of the assessment and how many jurisdictions are involved |
Questions buyers ask about US cloud providers under GDPR
Is Data Privacy Framework certification enough on its own for a US cloud provider?
No. DPF certification only covers transfers to organizations on the Data Privacy Framework List maintained by the US Department of Commerce, under Commission Implementing Decision (EU) 2023/1795. Your controller obligations still apply, and transfers to US recipients that are not on that list need another Chapter V tool, such as standard contractual clauses. Confirm three things before you rely on it: that the exact legal entity you contract with is listed, that the list covers the services you use, and that your processor terms reflect the decision. Your own records should show why you relied on it, so the assessment file is not empty if the provider's status changes.
Does the Latombe appeal change what we should do now?
Not on the facts available for October 2026. The General Court judgment in Case T-553/23 Latombe v Commission upheld the adequacy decision, and an appeal was lodged on 31 October 2025 (Case C-703/25 P). The Commission's adequacy page still lists US DPF participants as adequate. A pending appeal is a reason to keep a fallback ready, not to stop using DPF. Ask your provider to confirm its certification status and whether its standard contractual clauses are in place as a backup, and record a review date tied to the outcome of the appeal.
Does hosting in an EU region remove the transfer assessment?
Not by itself. Using an EU processor that is subject to third-country law with extraterritorial effect is not, by itself, a transfer under EDPB Guidelines 05/2021, but a request from a third-country authority that the processor complies with would be one. An EU region reduces the data flows you must map, but it does not remove the need to check whether US law could compel access and whether the provider's administrators or support staff can reach data from outside the EEA. If those paths exist, the transfer assessment and supplementary measures still apply.
Does encryption solve the risk of US government access?
Only in some designs. The EDPB's Recommendations 01/2020 accept encryption as a supplementary measure when the key is held outside the importer's reach and the data is not accessible in the clear in the destination. Use Case 6 states that where a cloud provider needs access to data in the clear and the destination's public authority powers go beyond what is necessary and proportionate, no effective technical measure can be envisioned. Provider-managed keys, or keys that the provider can retrieve, usually do not meet that test. Ask the provider exactly where keys are generated, stored and used, and who can access them.
How long does a transfer assessment take, and who signs it off?
The duration depends on how many providers and data flows you assess, how complete the provider's documentation is, and whether you need supplementary measures. Your organization is the controller and owns the assessment, so it is the party that decides and signs off. Legal, privacy and security staff usually share the work, and the EDPB recommends documenting each of its steps. Ask any consultant for a fixed scope, a list of deliverables and a named reviewer in writing. Ask the provider for its transparency reports and government access policy early, because those are often the slowest inputs to collect.
Can our team run the transfer assessment internally?
Often yes, for a small number of providers with clear documentation, if someone in the organization has the legal and technical skills and the time to keep the file current. The EDPB's six-step approach and the 2021 standard contractual clauses expect your organization to own the decision. An implementation partner such as DeployOpen can prepare the technical evidence, such as data flow maps, key management designs and access controls, under a written scope. It does not issue assessments or attestations, and an independent auditor or certification body is needed for any formal report.
How DeployOpen prepares the technical side of a US provider decision
DeployOpen works on the technical side of a decision to use a US cloud or SaaS provider under GDPR: where systems run, who can reach them, and what evidence supports the transfer analysis. The organization keeps ownership of the legal decision, its contracts and its controls, while DeployOpen prepares the systems and documentation that the assessment depends on.
How we scope
- Each engagement starts with a written scope that names the systems, data flows and providers under review.
- The scope lists which hosting regions, administrative paths and support channels the assessment will cover.
- Scope, deliverables and timelines are agreed in writing before any work begins, with no fixed prices published.
How we build
- We configure self-hosted open-source platforms inside your own cloud accounts, data centers or air-gapped networks.
- Encryption, key custody, access controls and logging are set up so that each transfer question has a documented technical answer.
- Where a US provider remains in the chain, we document which components reach personal data and from where.
How we hand over
- Deliverables include architecture records, data flow diagrams, access matrices and configuration evidence for your transfer assessment.
- We document the controls and their owners so your legal and security teams can review them and decide on contracts.
- Independent auditors or certification bodies, not DeployOpen, issue any reports or certificates that rely on this evidence.
How we support
- Ongoing support, upgrades and continuous security testing are available as retainers after handover.
- Re-evaluation matters when providers change terms, sub-processors or hosting locations, so we can review the documented setup on request.
- Confirm with your counsel and your chosen assessor which parts of the transfer analysis they will own before engagement starts.
Sources and further reading
- Commission Implementing Decision (EU) 2023/1795 on the EU-US Data Privacy Framework ↗
- Commission report COM(2024) 451 on the first periodic review of the EU-US Data Privacy Framework ↗
- Court of Justice of the EU press release 106/25 on Case T-553/23 Latombe v Commission ↗
- Official Journal C/2025/6610: appeal in Case C-703/25 P Latombe v Commission ↗
- European Commission: Adequacy decisions ↗
- Commission Implementing Decision (EU) 2021/914 on standard contractual clauses for transfers ↗
- EDPB Recommendations 01/2020 on measures that supplement transfer tools (version 2.0) ↗
