GDPR International Data Transfers: SCCs, Adequacy, and What's Changed

GDPR International Data Transfers: SCCs, Adequacy, and What's Changed Every time you use AWS to host EU customer data, send a support ticket to a US helpdesk, or sync contacts to Salesforce, GDPR's international data transfer rules apply. Most businesses using US SaaS tools are transferring EU personal data outside the European Economic Area — and many are doing it without the legal safeguards GDPR requires. GDPR international data transfers are one of the most complex areas of EU privacy law. The rules have been upended twice in recent years — first by the Schrems II ruling in 2020, which invalidated the EU-US Privacy Shield, then by the EU-US Data Privacy Framework in 2023, which restored a pathway for US transfers. But the legal landscape is still contested, and businesses that assume their tools are compliant by default are taking a significant risk. This guide explains the current state of GDPR international data transfers: what the law requires, which mechanisms are available, wh