GDPR, Schrems II and US cloud providers: where things stand

Q: What happens if the EU-US Data Privacy Framework is invalidated or suspended in the future?

If the CJEU overturns the *Latombe* ruling on appeal or the European Commission suspends the DPF due to changes in US executive orders, transfers to US clouds would fall back to Standard Contractual Clauses (SCCs). Under the *Schrems II* rules, companies using SCCs must conduct a Transfer Impact Assessment and apply technical supplementary measures that prevent US intelligence access—something that is difficult to achieve when a cloud provider processes unencrypted data in memory.

GDPR, Schrems II and US cloud providers: where things stand

European companies can currently use US cloud providers legally under the GDPR, provided the provider is certified under the EU-US Data Privacy Framework (DPF) or the customer has valid Standard Contractual Clauses (SCCs) and a Transfer Impact Assessment in place. In July 2023, the European Commission adopted the DPF adequacy decision, and in September 2025, the EU General Court upheld the framework in the Latombe v. Commission ruling. However, legal uncertainty remains. The General Court ruling is under appeal before the European Court of Justice (Case C-703/25 P), the DPF relies on US executive orders that a US president can modify or revoke, and US laws like the CLOUD Act still apply to US-headquartered companies regardless of where data is stored. For European businesses, using a US cloud is not unlawful today, but it carries ongoing compliance overhead and structural legal risk that EU-owned cloud providers avoid.

Key takeaways

Transfers to US clouds are currently legal: The EU-US Data Privacy Framework (DPF) provides a valid legal mechanism under GDPR Article 45 for transferring personal data to certified US cloud providers like AWS, Google Cloud, and Microsoft Azure.
The first legal challenge failed, but appeals continue: On September 3, 2025, the EU General Court dismissed a challenge against the DPF (Latombe v. Commission), though an appeal was filed with the Court of Justice of the European Union (CJEU) in October 2025.
EU data residency is not legal immunity: Hosting your servers in Frankfurt or Dublin on a US cloud keeps data physically in Europe, but the US parent company remains subject to the US CLOUD Act and FISA Section 702.
Compliance vs. risk reduction: Relying on the DPF satisfies immediate GDPR transfer rules, while using an EU-owned cloud provider removes third-country transfer risks and extraterritorial US jurisdiction altogether.
Exit strategies are becoming mandatory: Regulations like DORA (for financial entities) require documented exit strategies, and the EU Data Act eliminates cloud switching and egress fees from January 12, 2027.

How we got here: from Safe Harbor to Schrems II

Under Chapter V of the General Data Protection Regulation (GDPR), companies cannot transfer personal data outside the European Economic Area (EEA) unless the destination country ensures an “essentially equivalent” level of data protection. For twenty-five years, the European Commission and the United States government have tried to bridge the gap between EU privacy rights and US national security laws through special agreements.

The first two agreements were struck down by the Court of Justice of the European Union (CJEU) following complaints by Austrian privacy activist Max Schrems:

Safe Harbor (2000–2015): Invalidated in the Schrems I ruling (Case C-362/14) after revelations of mass surveillance by US intelligence agencies showed that EU citizens’ data had no meaningful protection in the US.
Privacy Shield (2016–2020): Invalidated in the Schrems II ruling (Case C-311/18) in July 2020. The CJEU found that US surveillance laws, specifically Section 702 of the Foreign Intelligence Surveillance Act (FISA) and Executive Order 12333, did not limit data collection to what was strictly necessary and proportional. Furthermore, EU citizens had no effective right to judicial redress in US courts.

In Schrems II, the court kept Standard Contractual Clauses (SCCs) alive as an alternative transfer tool, but with a strict catch. A contract between two companies cannot bind the US government. Therefore, companies using SCCs had to complete a Transfer Impact Assessment (TIA) and implement “supplementary measures”—such as encryption where the cloud provider never holds the keys—if US intelligence laws could apply. For companies running active databases, virtual machines, or application logic in the cloud, withholding encryption keys from the cloud provider is technically impossible.

Where things stand: the EU-US Data Privacy Framework

To resolve the crisis created by Schrems II, the US and the EU negotiated a third agreement. In October 2022, the US President signed Executive Order 14086, which introduced binding safeguards restricting US intelligence collection to what is “necessary and proportionate” and created a two-tier redress system, including a Data Protection Review Court (DPRC) within the US Department of Justice.

On July 10, 2023, the European Commission adopted Implementing Decision (EU) 2023/1795, declaring the new EU-US Data Privacy Framework (DPF) adequate. Major US cloud providers—including Amazon, Google, Microsoft, and DigitalOcean—self-certified under the DPF.

The Latombe ruling and ongoing appeals

Unlike its predecessors, the DPF survived its first test in court. French Member of Parliament Philippe Latombe filed a direct action for annulment against the framework (Case T-553/23). On September 3, 2025, the EU General Court dismissed the challenge and upheld the DPF. The General Court ruled that, based on the legal situation when the decision was adopted in 2023, the Data Protection Review Court offered sufficient guarantees of independence and that ex-post judicial review of bulk data collection met the standards set in Schrems II.

However, the legal story is not finished for three reasons:

Pending CJEU appeal: On October 31, 2025, Latombe appealed the General Court’s decision to the Court of Justice of the European Union (Case C-703/25 P). Privacy advocacy groups such as NOYB (led by Max Schrems) have also indicated they may bring separate challenges through national data protection authorities.
Executive order dependency: The core safeguards that make the DPF legal under EU law are not enshrined in a permanent Act of the US Congress. They rest on Executive Order 14086 and Department of Justice regulations. A US administration can amend or revoke an executive order at any time, or alter the independence of executive branch oversight boards. If those safeguards are weakened, the European Commission is legally required under GDPR Article 45(4) to suspend or repeal the adequacy decision.
FISA Section 702 reauthorizations: Section 702 of FISA, which permits the US government to compel US electronic communication service providers to turn over data of non-US persons located outside the US, was reauthorized and expanded by the US Congress in April 2024 (RISAA). How these statutory changes interact with the DPF during future Commission reviews remains a point of friction.

Why “EU regions” on US clouds do not solve the core issue

When European founders and engineering leads look at GDPR compliance, their first step is almost always selecting an EU region—such as eu-central-1 (Frankfurt) on AWS or europe-west1 (Belgium) on Google Cloud.

Keeping data in an EU data center is good practice for latency and baseline data residency, but it does not change the jurisdiction of the cloud provider. There are two reasons why an EU region on a US cloud is different from an EU-owned cloud:

1. Remote access and global support counts as a transfer

Under guidelines from the European Data Protection Board (EDPB), a “transfer” to a third country occurs not only when data is stored on a disk outside the EEA, but also when it is accessed remotely from outside the EEA. Major cloud providers operate “follow-the-sun” engineering, security, and support teams, as well as global control planes. Even when your database sits in Frankfurt, administrative metadata, support tickets, or troubleshooting access may involve personnel in the US or other non-EEA countries.

2. The US CLOUD Act and FISA 702 follow ownership, not geography

Enacted in 2018, the US Clarifying Lawful Overseas Use of Data (CLOUD) Act amended the Stored Communications Act (18 U.S.C. § 2713). It states that a US service provider must preserve, backup, or disclose data in its “possession, custody, or control,” regardless of whether that data is located within or outside of the United States.

Even dedicated “sovereign” offerings from US hyperscalers do not completely sever this link. For example, the AWS European Sovereign Cloud keeps data and day-to-day operations inside the EU using EU-resident staff, but it remains wholly owned by Amazon, a US corporation. Because ultimate corporate control rests in the United States, a conflict of law still exists between US disclosure orders and GDPR Article 48 (which states that foreign court or administrative orders are only recognized in the EU if based on an international treaty, like a Mutual Legal Assistance Treaty).

Comparing infrastructure options for European companies

To help your legal and technical teams evaluate where your infrastructure stands, the table below compares the three main hosting models available to European companies.

Criteria	US Cloud (Standard EU Region)	US Cloud (“Sovereign” EU Offering)	EU-Owned Cloud Provider
Examples	AWS Frankfurt, GCP Belgium, Azure Ireland, DigitalOcean Frankfurt	AWS European Sovereign Cloud, Microsoft Cloud for Sovereignty	UpCloud, Scaleway, Hetzner, OVHcloud, STACKIT, IONOS, Exoscale
Physical data location	EEA	EEA	EEA
Parent company jurisdiction	United States	United States	EU / EEA (or Switzerland for Exoscale, covered by adequacy)
Subject to US CLOUD Act & FISA 702	Yes	Yes (via ultimate parent company ownership)	No (provided no US corporate nexus with custody/control)
GDPR Chapter V transfer mechanism needed?	Yes (DPF certification or SCCs + TIA)	Often yes for parent/subprocessor chains; requires careful contract review	No (if all processing and subprocessors remain in the EEA)
Risk if DPF is invalidated or suspended	High: must fall back to SCCs, update TIAs, and defend supplementary measures	Medium to High: depends on corporate and technical ring-fencing	None: data never leaves EEA jurisdiction or control

How other EU regulations connect: DORA and the Data Act

Data protection is no longer the only regulatory pressure on cloud architecture. Two recent EU laws directly affect how 10-to-300-person European companies manage cloud providers:

DORA (Regulation (EU) 2022/2554): Applying since January 17, 2025, the Digital Operational Resilience Act regulates financial entities in the EU (including fintechs, payment institutions, and insurers) and their ICT third-party providers. DORA requires companies to assess concentration risk and maintain documented, tested exit strategies for ICT services supporting critical or important functions. If your company sells software to banks or insurers, their procurement teams will increasingly pass these requirements down to you.
The EU Data Act (Regulation (EU) 2023/2854): The Data Act removes the financial and contractual barriers that historically locked companies into a single cloud provider. Under Article 29 of the Data Act, cloud switching charges—including data egress fees when moving to another provider—may be charged at no more than the provider’s direct cost until January 12, 2027, and are completely banned from January 12, 2027 onward.

Practical checklist: what your company should do now

Whether you plan to stay on a US cloud, move to an EU provider, or run a hybrid setup, you should take concrete steps to document your compliance and reduce operational risk.

Verify DPF certification if you stay on a US cloud: Check the official US Department of Commerce Data Privacy Framework list to confirm that your cloud provider and all US-based SaaS subprocessors have an active certification. Update your privacy policy and Record of Processing Activities (RoPA) to reference the DPF alongside SCCs as a fallback.
Audit your customer contracts: Review the Data Processing Agreements (DPAs) you have signed with your own B2B customers. Many European public sector bodies, healthcare organizations, and financial institutions have procurement policies that restrict non-EU subprocessors regardless of whether the DPF is currently valid.
Keep architecture portable: Avoid locking core business logic into proprietary cloud services that cannot be moved without rewriting your application. Standardize on portable building blocks: Linux virtual machines, Kubernetes, PostgreSQL or MySQL, Redis-compatible caches, S3-compatible object storage, and Terraform or OpenTofu for infrastructure as code.
Maintain an infrastructure exit plan: Document what it would take to move your compute and data to a different provider if the DPF is suspended, if customer procurement demands EU hosting, or if you need to meet DORA exit strategy rules.

Frequently asked questions

No. As of 2026, using AWS, Google Cloud, Azure, or DigitalOcean is legal under the GDPR if the provider is certified under the EU-US Data Privacy Framework (DPF) and you have signed their Data Processing Agreement. However, because the DPF is subject to an appeal before the Court of Justice (Case C-703/25 P) and relies on US executive orders, the long-term stability of the framework is not certain.

Does keeping all my servers in Frankfurt or Dublin make me immune to the US CLOUD Act?

No. The US CLOUD Act applies to any company under US jurisdiction and covers data in that company’s “possession, custody, or control,” regardless of whether the servers are physically located in the United States or in the European Union. Selecting an EU region solves physical data residency and latency, but it does not change the legal jurisdiction of a US-owned parent company.

What happens if the EU-US Data Privacy Framework is invalidated or suspended in the future?

If the CJEU overturns the Latombe ruling on appeal or the European Commission suspends the DPF due to changes in US executive orders, transfers to US clouds would fall back to Standard Contractual Clauses (SCCs). Under the Schrems II rules, companies using SCCs must conduct a Transfer Impact Assessment and apply technical supplementary measures that prevent US intelligence access—something that is difficult to achieve when a cloud provider processes unencrypted data in memory.

Are European cloud providers ready for standard production workloads?

Yes, for standard infrastructure stacks. Providers like UpCloud, Scaleway, Hetzner, OVHcloud, STACKIT, IONOS, and Exoscale offer virtual machines, private networks, load balancers, S3-compatible object storage, and (on most platforms) managed PostgreSQL/MySQL and managed Kubernetes. They do not replace proprietary hyperscale services like DynamoDB or BigQuery, so companies using standard open-source technologies have the easiest path to EU clouds.

How MoveInfra can help

If you decide that moving off a US cloud is the right way to simplify your GDPR compliance and meet customer sovereignty requirements, MoveInfra handles the migration to EU-owned providers like UpCloud, Scaleway, Hetzner, and OVHcloud for a fixed price. We rebuild your environment as clean Terraform code, sync your databases and object storage with a planned cutover window that requires only a short write pause, and maintain reverse replication for 30 days so you always have a safe rollback option. You can start by uploading your current cloud bill on our website for a free cost and compatibility analysis without granting any access to your systems.