Does the GDPR for US companies start with the Data Privacy Framework or SCCs?
A US company that receives a customer's request for GDPR terms usually needs to answer one question first: which mechanism covers the transfer of EU personal data to the United States. A US recipient on the Data Privacy Framework List can rely on the Commission's adequacy decision, while any other US recipient needs standard contractual clauses or another Chapter V tool. The General Court upheld the adequacy decision in Case T-553/23, but an appeal (Case C-703/25 P) is pending, and the Commission's adequacy page still lists DPF participants as adequate. Your legal or privacy team should record the mechanism, the date it was checked and the appeal status in the transfer file, and confirm the current position on the EUR-Lex text of the adequacy decision and the Commission's adequacy list before you sign. The organization owns this decision. An implementation partner can help prepare the evidence, such as a current DPF certification record, the clauses in the contract, or a transfer impact assessment, but neither the partner nor a technical team should choose the mechanism. That choice belongs to the company and its legal advisers. Three facts change the answer. First, whether the company appears on the DPF List maintained by the US Department of Commerce, and whether the certification covers the data types and services the customer uses. Second, whether Article 3(2) applies, because a US company that offers goods or services to people in the Union, or monitors their behaviour there, must also consider the representative duty and the rules for data flowing back to the United States. Third, where the data actually flows, including sub-processors, support access from outside the EEA and backups held elsewhere. If the company is not on the DPF List, or the customer's data flows through systems the certification does not cover, the practical path is SCCs under Commission Implementing Decision (EU) 2021/914, with a documented assessment of US public authority access. Clauses 14 and 15 require the importer to warrant that it has no reason to believe local law prevents compliance and to review and, where grounds exist, challenge unlawful access requests. Ask your counsel which risk would change the transfer decision, and plan a review trigger for each change in the adequacy position.
DPF, SCCs or another tool: which fits your data flows
A US organization that is certified and listed on the Data Privacy Framework List maintained by the US Department of Commerce can rely on the adequacy decision in Commission Implementing Decision (EU) 2023/1795 for transfers from the EU to that organization. The decision covers only organizations on the List, so the first step is confirming that the entity receiving the data is listed, under the correct scope, and that the certification is current. Adequacy does not remove the GDPR duties that apply to controllers and processors, and it does not end the need to document the flow. Some customers will still ask for standard contractual clauses as a backstop, so it is worth checking the contract terms before a customer asks.
- Confirm the List entry: Check that the importing entity, and not only its parent, appears on the List and that its certification covers the data types and HR or non-HR scope involved.
- Record the transfer basis: Keep the reliance on the adequacy decision in the record of processing and the transfer register, with the date of the List check.
- Monitor certification status: Set a recurring check, since a lapsed or withdrawn certification removes the basis for reliance.
- Track the court appeal: The General Court judgment in Case T-553/23 was appealed in Case C-703/25 P, so note the appeal in your legal review and watch for any change to the adequacy position.
- Prepare a fallback: Hold a signed set of standard contractual clauses for key customers so the flow continues if the adequacy basis is challenged.
Before relying on the List, confirm the entry directly on the Department of Commerce list and document the check.
A US recipient that is not on the Data Privacy Framework List is outside the adequacy decision, so a transfer from the EU to it needs another Chapter V tool. The usual tool is the standard contractual clauses adopted in Commission Implementing Decision (EU) 2021/914, placed between the exporter and the importer and chosen to match the transfer's roles. The exporter must then assess whether the clauses work in practice for that destination, including the importer's legal environment. The controller or processor should be able to show that the clauses were signed, that the module is correct, and that the transfer impact assessment was completed and kept on file.
- Choose the right module: Select the clause module that matches the roles, such as controller to processor or processor to processor, rather than reusing one template for every flow.
- Complete the transfer impact assessment: Document the destination's laws and practices, the data types, and the supplementary measures such as encryption and access controls.
- Clause 14 warranty: The parties warrant that they have no reason to believe the destination's laws and practices, including public authority access, prevent the importer from meeting its obligations. The warranty depends on the assessment being real, so the record must show the reasoning.
- Clause 15 duties: The importer must review the legality of any public authority request and, where there are reasonable grounds, challenge it, and must notify the exporter.
- Keep the paper trail: Store the signed clauses, annexes listing the data and recipients, and any sub-processor flow-downs together.
Ask the importer for its government access history and its policy on challenging requests, and record its answers in the transfer file.
A US company may host personal data in the EU with an EU processor and still ask whether a transfer occurs. EDPB Guidelines 05/2021, Example 12, distinguishes two things. Using an EU processor that is subject to third-country law with extraterritorial effect is not in itself a transfer. However, if that processor complies with a third-country authority request, that disclosure would be a transfer, and if the processor does so against the controller's instructions, it becomes a controller under Article 28(10). The question therefore turns on who sends data where, and on the instructions given. This is an illustrative case: a company with EU-hosted data should document the hosting location, the processor's governing law, and what happens if a foreign request arrives.
- Map every access path: List the EU hosting location, the EU processor, and any non-EU staff or support access, since remote access from outside the EEA can itself be a transfer.
- Document extraterritorial exposure: Record which foreign laws could reach the processor, so the risk is known rather than assumed.
- Set instructions for government requests: Put in the contract how the processor must handle an authority request, including notice to the controller and challenge where lawful.
- Recheck when the parent changes: If a US parent gains access to the data, treat that access as a separate flow requiring its own tool.
- Involve the EU processor: Ask it to confirm, in writing, its hosting and access arrangements.
Confirm with counsel whether any access path creates a transfer before choosing the tool, and record the conclusion with its reasons.
Standard contractual clauses as the fallback and what the transfer assessment must cover
Standard contractual clauses are the fallback whenever the US recipient is not on the Data Privacy Framework List, because the adequacy decision covers only organizations on that list. The same applies when a company wants a second basis in place in case the DPF is invalidated. The clauses adopted in Commission Implementing Decision (EU) 2021/914 are the usual tool, and the decision's text, not a summary, should be what the contract incorporates. Check which module fits the relationship (controller to processor, or processor to processor) before signing, because the wrong module leaves gaps that an assessor will find. Under Clause 14, the parties warrant that they have no reason to believe the destination country's laws and practices, including disclosure requirements and public authority access, prevent the importer from meeting its obligations. That warranty is only credible if it rests on a documented assessment. The exporter and the importer must look at the actual US laws that could reach the data, the importer's own history of government requests, the type and sensitivity of the data, and any supplementary measures such as encryption where the importer holds no key. Confirm with counsel which US authorities and statutes the importer is exposed to, and record the conclusion for each transfer.
Under Clause 15, the importer must review the legality of any public authority request and, where there are reasonable grounds, challenge it. It must also notify the exporter and, where it can, the data subject, and it must document the request and its response. The contract should name who receives those notices and how fast, and the importer's internal process for handling a request should be tested before it is needed. The transfer assessment is the organization's responsibility, not the importer's or the vendor's, and it has to be repeated when the facts change. An outside advisor can prepare the assessment, document the reasoning and keep the records current, but cannot guarantee the result: the conclusion depends on the law and the facts at the time. Ask any advisor to state the assumptions and the open questions in writing, and review the Commission's adequacy decisions page to confirm the status of the DPF before you rely on either tool.
Do you need an EU representative under Article 27?
Article 27(1) applies only when a company outside the EU falls within Article 3(2) and must appoint a representative in writing. The cards below walk through the trigger, what the representative does and does not do, the exemptions to take to counsel, and how the role connects to breach notice across Member States.
Check the Article 3(2) trigger
The representative duty only arises if the GDPR already applies to you through Article 3(2). That means you have no EU establishment, but you offer goods or services to people in the Union, paid or free, or you monitor their behaviour where it takes place in the Union. A US SaaS company selling to EU customers usually needs to answer this question first. Map which products, sign-up flows and marketing campaigns reach people in the Union, and record the answer, because it decides whether the rest of this section applies.
Designate in writing
Where Article 3(2) applies, Article 27(1) requires a controller or processor not established in the Union to designate a representative in the Union in writing. The designation should be a signed document that names the representative, states its mandate and is kept with your records of processing. Verbal arrangements or a website footnote do not evidence the designation. Ask counsel to confirm the form of the mandate and who in your organization signs it.
Know what the representative does not do
The representative acts as a point of contact for supervisory authorities and data subjects on GDPR matters. It does not carry your compliance duties, does not approve your processing, and does not take on your liability for breaches. Your organization still owns its controls, records and responses to rights requests. Confirm in the mandate which communications the representative forwards to you and how quickly, so that a regulator's question does not sit unanswered in a shared inbox.
Check the exemptions with counsel
Article 27(2) sets out limited exemptions, including processing that is occasional, does not involve large-scale special category or criminal offence data, and is unlikely to risk rights and freedoms, and public authorities or bodies. These exemptions are narrow and are easy to misjudge for SaaS products that process data continuously. Do not rely on an internal reading alone. Ask counsel to document the analysis for each product line, and revisit it when a new market or data category is added.
Price the representative service
Representative services are typically paid as a recurring fee for the mandate, plus any extra charges for handling volumes of requests or regulator contact. Cost drivers include the number of Member States you serve, the languages required, the expected volume of inquiries, and whether the provider also acts as a contact for data subject rights. Ask for the fee structure in writing, what is one-time (onboarding, mandate drafting) and what recurs, and how mandate changes are priced. Compare the quote against the scope you actually need.
Align breach notice across Member States
A representative does not replace your own breach notice duties. If personal data breaches affect people in several Member States, you may need to notify the relevant supervisory authorities within the 72-hour window in Article 33, so your incident plan should name who contacts each authority, who speaks for the representative, and how the representative receives the notice. Test this path in a tabletop exercise before an incident, and confirm with the provider how quickly it can pass information to you.
How a US company puts its transfer and representative position in place
The sequence below takes a US company from knowing its data flows to a documented transfer position, a named EU representative where required, and a standing check on the pending appeal. Each step produces a record that a customer, regulator or assessor can test.
Map data flows and recipients
Start by listing every place personal data about people in the EU or EEA goes, including customers, employees, hosting providers, support tools and sub-processors. Record which entity sends it, which US or non-EU entity receives it, and whether that recipient is the controller, processor or sub-processor. The legal and privacy team owns the map, with engineering confirming the systems. Done means a dated data flow register that names every recipient and marks each flow that crosses to the United States.
Check Data Privacy Framework List status
For each US recipient, confirm whether the organization is on the Data Privacy Framework List maintained by the US Department of Commerce. Coverage under the Commission's adequacy decision applies only to listed organizations, so a recipient that is absent needs another transfer tool. Record the check date, the list entry and whether the entry covers the data categories in scope. Done means each recipient is marked covered or not covered, with the evidence saved.
Track the pending appeal and its effect
Review the status of the General Court judgment in Case T-553/23 Latombe v Commission and the appeal lodged in Case C-703/25 P. The General Court dismissed the annulment action, but the appeal is pending, and the Commission's adequacy page still lists US DPF participants as adequate. Ask counsel to write down what would change for your flows if the decision were set aside, and which fallback tool would apply. Done means a short written position on the appeal, owned by legal, with a named reviewer.
Select standard contractual clauses where needed
For every recipient that is not covered by the Data Privacy Framework, or for flows where you want a fallback in place, put in the standard contractual clauses adopted under Commission Implementing Decision (EU) 2021/914 and select the modules that match each role. Confirm the parties, the data categories, the purposes and the annexes are completed for each flow. Done means signed clauses for each non-covered flow, held in the contract repository and linked to the data flow register.
Complete the transfer assessment
Document a transfer assessment for each flow relying on standard contractual clauses or on a fallback. Using Clause 14, record whether there is reason to believe the destination country's laws and practices, including public authority access, would prevent the importer from complying. Note the supplementary measures, such as encryption and access controls, and the importer's commitment under Clause 15 to review and challenge unlawful requests. Done means a signed assessment per flow, reviewed by a qualified person and refreshed when the facts change.
Appoint the EU representative if Article 3(2) applies
If the company is not established in the Union and offers goods or services to people in the Union, or monitors their behaviour there, Article 27(1) requires a written designation of a representative in the Union. Confirm applicability with counsel first, then appoint a representative in writing and record the mandate, the contact details and the countries where the representative is reachable by data subjects and authorities. The representative receives regulator and data subject contacts, but does not replace the company's own obligations. Done means a signed written designation on file and the contact published in the privacy notice.
Update contracts and privacy notices
Update the data processing agreement with customers so that it names the transfer mechanism for each flow, the sub-processors and the transfer locations. Update the privacy notice so that it describes transfers to the United States, the safeguard relied on and how a copy can be obtained, and names the EU representative where one is appointed. Legal owns the text and sales or procurement confirms the customer-facing versions. Done means a version-controlled contract template and notice that match the data flow register.
Monitor the appeal and the register
Set a standing review of the appeal, the Commission's adequacy page, the DPF List and the periodic review cycle, and record each review in the same register. When a recipient leaves the list, a flow changes or the appeal produces a decision, update the transfer tool, the assessment and the notices in that order. Ask your counsel, and any outside help, to confirm the current status before relying on it. Done means a dated review log that shows the position was checked and what changed.
Who owns each part of the transfer and representative work
This table shows who owns each step of the transfer and EU representative work: the company, the implementation partner, the EU representative provider, and the independent assessor or counsel. Read each row as a question of accountability, since the company keeps legal responsibility for every decision even when a partner prepares the systems and evidence. DeployOpen prepares systems and evidence but does not issue reports or certificates.
| Task | Company | Implementation partner | EU representative provider and assessor or counsel |
|---|---|---|---|
| Transfer mechanism decision | Decides whether the EU-US Data Privacy Framework or standard contractual clauses apply to each recipient | Maps data flows and supplies the recipient and sub-processor inventory the decision depends on | Counsel confirms the analysis and advises on changes to the recipient's DPF status |
| SCC execution | Signs the clauses with each importer and holds the executed copies | Configures systems and contract records so the executed clauses map to the correct data flows | Counsel reviews clause selection and any non-standard amendments |
| Transfer assessment | Owns the assessment of destination country laws and documents the conclusion | Gathers technical facts such as hosting locations, access paths and encryption settings | Independent counsel or assessor reviews the reasoning where the file is high risk |
| EU representative designation | Appoints the representative in writing where Article 3(2) applies and records the appointment | Keeps the representative's contact details current in privacy notices and internal records | Representative provider accepts the written mandate and handles regulator contact in the Union |
| Technical controls and logs | Approves access rules, retention and government request procedures | Implements access control, encryption, logging and restricted administration as agreed in scope | Assessor tests the controls on request, if the company commissions an assessment |
| Reporting | Issues customer and regulator responses and keeps the accountable record | Provides evidence packs, configuration exports and written system descriptions | Only an independent auditor, assessor or certification body issues reports or certificates |
What to have ready before a customer or regulator asks
Customers and supervisory authorities usually ask the same question first: where does personal data go, and on what legal basis? The six items below are the records that answer it, and each one should be checked before a request arrives, not assembled under deadline.
Record of processing entries for transfers
Each processing activity that sends personal data outside the EEA needs an entry in the record of processing that names the recipient country, the recipient organization, the transfer mechanism and the categories of data. Check that every US recipient appears by legal name, that the entry matches what engineering actually deploys, and that it is reviewed when a new vendor or region is added. An entry that says only "cloud hosting" will not survive a customer audit.
DPF List check
Confirm the importer is on the Data Privacy Framework List before relying on the adequacy decision. The decision covers only organizations on the list maintained by the US Department of Commerce, so a recipient that certified once and later lapsed is not covered. Save a dated screenshot or export of the listing for each US recipient, record whether the certification covers HR or non-HR data, and recheck the list on a schedule.
Executed standard contractual clauses
Recipients that are not on the DPF List, or any recipient where you want a fallback, need another Chapter V tool, most often the standard contractual clauses adopted by Commission Implementing Decision (EU) 2021/914. Check that the signed version uses the correct modules for each role (controller to processor, processor to processor and so on), that the annexes list the actual data, purposes and sub-processors, and that the signatory had authority to bind the company.
Transfer assessment file
Where SCCs are used, the file should show a documented assessment of the destination country's laws and practices, including public authority access, and the supplementary measures chosen. Clause 14 requires the parties to warrant that they have no reason to believe local law prevents compliance, and Clause 15 requires the importer to review and challenge unlawful public authority requests. Check that the file is dated, names who reviewed it, and is revisited when the legal position changes.
EU representative contract
A US company that falls under Article 3(2) must designate a representative in the Union in writing under Article 27(1), unless an exemption applies. Check that the written mandate is signed, names the representative as the point of contact for supervisory authorities and data subjects, and sets out what the representative receives and passes on. Confirm the representative's details appear in privacy notices and that the company can reach them quickly during a breach.
Sub-processor transfer locations
Every sub-processor in your chain can create a transfer, including support staff, logging vendors and backup providers located outside the EEA. Keep a current list that names each sub-processor, its processing location, remote access locations and the transfer mechanism that covers it. Check that flow-down terms reach each sub-processor and that customers were notified of changes within the period set in your contracts.
Questions US companies ask before hiring help with GDPR transfers
Can a US company self-certify to the EU-US Data Privacy Framework on its own?
Yes, an organization can join the Data Privacy Framework by certifying its own participation, but only if it meets the program requirements and is placed on the Data Privacy Framework List maintained by the US Department of Commerce. Transfers from the EU are covered by the adequacy decision only for organizations on that list, so a company that is not listed needs another Chapter V tool, such as standard contractual clauses. Work that drives the effort includes mapping which personal data you receive from the EU, deciding which privacy notices and recourse mechanisms apply, and confirming that your sub-processors and affiliates are covered. Ask any outside helper to show how each requirement maps to a document and an owner in your own company.
What does the pending appeal mean for transfers made under the DPF today?
The General Court dismissed the challenge to the adequacy decision in Case T-553/23, but an appeal was lodged in Case C-703/25 P, so the outcome is not yet settled. The Commission's adequacy page still lists US DPF participants as adequate, which means listed organizations can keep relying on the decision while the appeal is open. Companies should not treat that as a permanent position. A practical step is to keep a signed standard contractual clauses package ready as a fallback, so that a change in the decision does not stop data flows. Confirm the current status of the appeal on the EUR-Lex and Commission pages before you advise customers or update contracts.
Do existing standard contractual clauses still work if the DPF is struck down?
Standard contractual clauses under Commission Implementing Decision (EU) 2021/914 remain a separate Chapter V tool that does not depend on the adequacy decision, so an executed set can continue to serve as the transfer basis if the DPF changes. That only holds if the clauses are correctly completed, annexes list the actual transfers and sub-processors, and the parties have done the transfer assessment that Clauses 14 and 15 require. Those clauses ask the importer to assess whether destination country laws and public authority access would prevent compliance and to challenge unlawful requests where there are reasonable grounds. Plan for that assessment to be repeated when the legal position moves, not only at signing.
Does a US company always need an EU representative under the GDPR?
No, a US company needs an EU representative only when Article 3(2) applies to its processing, and even then the duty can have exemptions that a lawyer should confirm for your specific processing. Article 3(2) is triggered when the company offers goods or services to people in the Union or monitors their behavior there. A company that serves only US customers and does not monitor EU individuals usually falls outside that scope, while a SaaS product sold to EU businesses and used by EU staff may not. Ask counsel to document the scope analysis against the EDPB Guidelines 3/2018, because the representative appointment must be in writing and the answer shapes everything else in the transfer plan.
What does the work need from our internal staff?
The engagement needs named people who can answer for the business, not only for IT. Expect requests for a data inventory showing which systems hold EU personal data, the contracts and sub-processor lists in use, the current security measures, and decisions on which entity is the controller or processor for each activity. Engineering staff must confirm where data is stored, who can access it from outside the EEA, and how remote support works. Legal or privacy staff must own the DPF certification decision and the transfer assessments. The more complete the internal inventory is at the start, the shorter the discovery phase tends to be, and the less time your staff spend re-answering the same questions.
How long does transfer work take, and what drives the timeline?
The timeline depends on the number of data flows, the number of sub-processors, how many entities are involved, and whether you need to certify to the DPF, sign standard contractual clauses, or both. Each transfer needs a documented assessment, so the count of flows and recipients is the main driver. Other factors include whether your current contracts already reference the clauses, how quickly your sub-processors respond to requests for information, and whether a representative appointment is needed. Ask any provider for a written scope that lists these items and the deliverables for each, since most engagements are agreed as fixed scope before work starts and a quote follows from that scope.
Can an implementation partner replace privacy counsel for transfers?
No. An implementation partner can prepare systems, data maps, configuration evidence and transfer documentation, but the legal conclusions belong to your company and its qualified counsel. DeployOpen plans, implements and documents self-hosted open-source platforms inside your own infrastructure and prepares evidence for compliance assessments, but it does not issue legal opinions, certifications or attestations. Independent auditors and certification bodies issue reports where they apply. The most efficient arrangement is usually to have counsel own the transfer analysis and the DPF or clauses decision, while the technical partner supplies accurate data flow evidence and keeps it current as systems change.
How DeployOpen supports transfer evidence on self-hosted platforms
DeployOpen plans, implements and documents self-hosted open-source platforms inside the client's own cloud accounts, data centers or air-gapped networks, so the client decides where personal data is stored and which administrative paths can reach it. That matters for transfers because the first question in a transfer file is whether data leaves the EU or EEA at all, and who outside it can reach the systems. DeployOpen can help the client trace those answers into the platform design: hosting regions, backup locations, logging destinations, support access routes and any remote administration from outside the EEA. The client owns the data-flow map and the decisions it records.
In practice, DeployOpen can prepare the technical evidence a transfer file usually needs. This includes a current data-flow diagram per platform, a list of systems and sub-processors with their locations, configuration exports showing region settings and access controls, and records of how privileged access is granted and reviewed. Where a US recipient relies on the Data Privacy Framework or standard contractual clauses, these records support the client's own assessment of the recipient's obligations and of any public authority access risk. The client should confirm with its counsel which documents the transfer file requires and how often they must be refreshed.
DeployOpen does not provide legal advice on transfer mechanisms, does not appoint representatives, and does not issue audit reports or certificates. Choosing between the Data Privacy Framework and standard contractual clauses, deciding whether an EU representative is needed, and assessing a foreign authority request are decisions for the client, its legal advisers and, where relevant, an independent assessor or the supervisory authority. Before engaging DeployOpen, ask for the scope of technical evidence in writing, including which systems, locations and roles it covers, so that the transfer file and the fixed-scope deliverables line up.
How DeployOpen works on this
DeployOpen works on the technical side of US-to-EU transfers: the systems, access paths, contracts-ready evidence and data flow records that a transfer decision depends on. We prepare the platform and the evidence, while your organization owns its transfer decisions and any independent assessor issues reports.
How we scope
- Map every flow of EU personal data to US-based recipients, support staff and sub-processors in the written scope.
- Record whether each recipient is on the Data Privacy Framework List or needs standard contractual clauses instead.
- Agree deliverables, timelines and exclusions in writing before work starts, since most engagements are fixed-scope.
How we build
- Configure self-hosted open-source platforms in your own cloud accounts or data centers so EU data stays where you decide.
- Restrict administrative and support access paths, and log them, so remote access from outside the EEA is visible and controlled.
- Build the technical measures your transfer impact assessment depends on, such as encryption key custody and access records.
How we hand over
- Document the data flow map, system configuration, access model and sub-processor details as evidence for your records.
- Provide a handover pack listing which controls you own, which we implemented and which still need your decision.
- Walk your legal, privacy and security teams through the evidence so they can review it before any contract is signed.
How we support
- Offer ongoing support, upgrades and continuous testing as a retainer after handover, if your transfer setup changes.
- Re-check the evidence when the Data Privacy Framework position changes, such as after the pending court appeal is decided.
- Confirm with your counsel and an independent assessor which transfer tool, and which assessment, your organization needs.
