← All Articles GDPR · Transfers 9 min read By the Sitetals Team Updated 6 September 2026

Data transfers outside the EU: US tools, the Data Privacy Framework and standard clauses, explained for a small business

A six-person architecture practice, a brochure website, a contact form. Behind the front page sit three US tools: the newsletter goes out through an email service, quotes are filed in a shared cloud drive, and a chat bubble in the bottom corner handles visitor questions. Every time a prospect leaves a name and an email address, that data leaves the European Union. The owner has been told that "transfers to the United States are no longer allowed". That is not what the regulation says. The GDPR does not prohibit transfers: it sets conditions for them, and it offers three routes to make them lawful. This article walks through the three routes and ends with a five-step method for a small business.

Disclaimer: this article is provided for information only and does not constitute legal advice. The texts cited are those in force at the time of writing; for a specific situation, consult a qualified legal professional.

Start here: three questions per tool

Before reading on, put these three questions to each of your providers. The answers decide which route applies.

Where is the data stored, and who can reach it? A server in Europe is not the end of the story if the provider's support team logs in from outside the EU.
Is the provider on the Data Privacy Framework list? If it is, the 2023 adequacy decision covers the transfer to that organisation.
If not, does its data processing addendum contain the 2021 standard contractual clauses? They usually sit in the "data processing" annex to the provider's terms.

What counts as a transfer

Chapter V of the GDPR, titled "Transfers of personal data to third countries or international organisations", opens with a general principle. Article 44 GDPR states that a transfer "shall take place only if [...] the conditions laid down in this Chapter are complied with by the controller and processor", including for onward transfers from the third country. The regulation does not define the word "transfer". The European Data Protection Board filled that gap in its Guidelines 05/2021 (version 2.0, adopted on 14 February 2023) with three cumulative criteria:

a controller or processor (the "exporter") is subject to the GDPR for the processing in question;
the exporter discloses by transmission or otherwise makes personal data available to another controller, joint controller or processor (the "importer");
the importer is in a third country, whether or not it is itself subject to the GDPR.

The same guidelines add that remote access from a third country, even if it only means displaying data on a screen for support or administration, and storage in a cloud located outside the EEA, are also considered a transfer when the three criteria are met. For the architecture practice, all three tools are caught: the email service stores the addresses in the United States, the cloud drive does too, and the chat tool gives a support team outside the EU access to the conversations.

One reassuring point: the country where a company is incorporated is not the test. What matters is where the data can be reached for that particular processing. A US provider that offers EU hosting with no access from outside may not be transferring at all. Ask the provider in writing and keep the answer.

Route 1: the adequacy decision and the Data Privacy Framework

Article 45(1) GDPR allows a transfer "where the Commission has decided that the third country, a territory or one or more specified sectors within that third country [...] ensures an adequate level of protection". Such a transfer "shall not require any specific authorisation". It is the simplest route: nothing to sign, nothing to assess yourself.

For the United States, that decision exists: Commission Implementing Decision (EU) 2023/1795 of 10 July 2023 on the EU-US Data Privacy Framework (DPF). Its Article 1 is precise: the United States ensures an adequate level of protection for personal data transferred "to organisations in the United States that are included in the 'Data Privacy Framework List'", maintained and published by the US Department of Commerce. Three practical consequences follow:

the decision does not cover "the United States" as a whole, but the organisations on that list;
the list is public, on the dataprivacyframework.gov website; that is where each provider is looked up, under its exact legal name, and a dated screenshot of the entry is worth keeping;
an organisation can leave the list; the check is repeated at every contract renewal.

The decision was challenged before the General Court of the European Union. In its judgment of 3 September 2025 in case T-553/23, the General Court (Tenth Chamber, Extended Composition) dismissed the action. At the time of writing, Decision 2023/1795 is therefore in force. Article 45(3) GDPR also provides that every adequacy decision includes a mechanism for periodic review, at least every four years: the position can change, which is one more reason to date your checks.

Route 2: appropriate safeguards and the standard contractual clauses

When the provider is not on the DPF list, or sits in another country with no adequacy decision, the next stop is Article 46 GDPR. Paragraph 1 allows the transfer if the controller or processor "has provided appropriate safeguards, and on condition that enforceable data subject rights and effective legal remedies for data subjects are available". Paragraph 2(c) lists, among those safeguards, "standard data protection clauses adopted by the Commission".

Those clauses are the ones in Commission Implementing Decision (EU) 2021/914 of 4 June 2021. They come in four modules depending on the roles of the parties; for a small business handing data to an online tool, module two (controller to processor) is the usual one. In practice the clauses are not negotiated: the provider builds them into its data processing addendum (the "DPA"), and the customer accepts them by signing or ticking a box. The work on the customer's side is to find that addendum, confirm that it refers to Decision 2021/914, and file a copy.

The clauses do not work alone. In its judgment of 16 July 2020 in case C-311/18, the Court of Justice (Grand Chamber) held that the assessment of the level of protection "must, in particular, take into consideration" both the contractual clauses agreed with the recipient and, as regards access by the public authorities of the third country, "the relevant aspects of the legal system of that third country". This is the origin of what is now called a transfer impact assessment. The EDPB set out the method in its Recommendations 01/2020 (version 2.0, 18 June 2021). For a small business, a reasonable version of that assessment fits on one page per provider: which country, which data, which transfer tool, which technical measures the provider applies (encryption, EU hosting), and a date.

Route 3: the Article 49 derogations

Article 49 GDPR opens with a condition: it applies only "in the absence of an adequacy decision [...] or of appropriate safeguards". It then lists specific situations, among them the explicit consent of the person, informed of the risks, and a transfer "necessary for the performance of a contract between the data subject and the controller". The French supervisory authority, on its page on transfers outside the EU, describes these exceptions as usable only in particular situations.

For a small business the conclusion is short: Article 49 is not a route for a tool used every day. A newsletter sent monthly to the whole list is not a particular situation. A derogation can cover an isolated case; it does not replace the DPF list or the standard clauses.

What the GDPR asks next: policy, record, contract

Once the route is chosen, three articles of the regulation ask for a visible trace of it.

The privacy policy. Article 13(1)(f) GDPR requires the person to be told, "where applicable", that the controller intends to transfer data to a third country, of "the existence or absence of an adequacy decision", or, for transfers under Article 46, of a "reference to the appropriate or suitable safeguards" and the means to obtain a copy. One sentence per provider is enough, provided it is true. Our article on the privacy policy shows where that sentence goes.
The record of processing. Article 30(1)(e) GDPR requires the record to state, "where applicable, transfers of personal data to a third country", including "the identification of that third country". A "country and transfer tool" column on each line of the record settles it. If you do not have a record yet, start with our article on the record and the 250-employee exemption.
The processor contract. Article 28(3)(a) GDPR provides that the processor processes personal data "only on documented instructions from the controller, including with regard to transfers of personal data to a third country". That contract, the DPA, is usually where the standard clauses live. The transfer and the processor contract are two sides of the same document.

Which tool, which route

The table below takes the three tools of the architecture practice and the most common situations. It does not replace a provider-by-provider check.

Situation	Transfer?	Preferred route	Where to record it
US email service, provider on the DPF list	Yes	Adequacy decision, Article 45 GDPR and Decision 2023/1795	Privacy policy, record, dated screenshot of the list entry
US cloud storage, provider not on the DPF list	Yes	Standard clauses, Article 46 GDPR and Decision 2021/914, in the DPA	Privacy policy, record, copy of the DPA, one-page assessment
Support chat hosted in the EU, support team outside the EU	Yes, through remote access	DPF list if the provider is on it, otherwise standard clauses (Article 46 GDPR)	Privacy policy, record, copy of the DPA
US hosting provider with an EU region enabled and access limited to the EU, confirmed in writing	No, if the three criteria are not met	None; keep the provider's written confirmation	Record (hosting location), Article 28 GDPR contract

The five-step method for a small business

Inventory. List every tool that receives data about your customers, prospects or staff: email marketing, CRM, storage, hosting, chat, online accounting, appointment booking. For each, note the provider's country and, if you know it, where the data is hosted and where support is located. A spreadsheet is enough.
DPF list. For each US provider, look up its legal name on the public Data Privacy Framework list. Keep a dated screenshot. A listed provider falls under Decision 2023/1795.
Standard clauses. For the others, open the provider's DPA and look for the reference to Decision 2021/914. Write the one-page assessment: country, data, transfer tool, technical measures, date. If the DPA contains nothing, write to the provider; silence is itself a signal.
Traceability. Add the country and the route to the matching line of the record (Article 30 GDPR) and one sentence per provider to the privacy policy (Article 13 GDPR).
Reduction. Where a provider offers an EU hosting region, switch it on; ask whether support can be limited to the EU. Fewer transfers means fewer assessments to keep current and less reliance on an adequacy decision that is reviewed periodically.

Checklist

Every tool that receives personal data is listed, with the provider's country, the hosting location and the support location.
For each US provider, the Data Privacy Framework list entry has been checked and a dated screenshot is kept.
For each provider not on the list, or located in another third country, the DPA containing the Decision 2021/914 standard clauses is filed, with a one-page assessment.
The record of processing states, for each line concerned, the third country and the route used.
The privacy policy mentions the transfers, the route relied on, and how to obtain a copy of the clauses.
EU hosting options have been enabled wherever the provider offers them.
A date for the next check is set, no later than each contract renewal.

Check that your legal pages are present

The free Sitetals check reviews your home page and reports, among other things, whether a legal notice page or a privacy policy page is missing or unreachable, and which third-party services your site loads. It is a starting point for the review described above, not a replacement for it.

Run the free check

Also worth reading:

Sources: Regulation (EU) 2016/679, Articles 13, 28, 30, 44, 45, 46 and 49 · Commission Implementing Decision (EU) 2023/1795 of 10 July 2023 · Commission Implementing Decision (EU) 2021/914 of 4 June 2021 · CJEU, judgment of 16 July 2020, case C-311/18 · General Court, judgment of 3 September 2025, case T-553/23 · EDPB Guidelines 05/2021, version 2.0 · EDPB Recommendations 01/2020, version 2.0 · CNIL, "Transférer des données hors de l'UE" · Sitetals methodology.

Sitetals editorial team