International Data Transfers Under GDPR: Adequacy, SCCs and the EU-US Data Privacy Framework After the Latombe Ruling

What are the three lawful ways to transfer personal data outside the EEA?

An adequacy decision, appropriate safeguards, or a narrow derogation — and in that order of preference, because each removes progressively less risk from the exporter. Article 45 lets the Commission declare that a third country’s laws already ensure "an adequate level of protection," in which case a transfer needs no further authorisation. Without that, Article 46 allows a transfer if the controller or processor has "provided appropriate safeguards, and on condition that enforceable data subject rights and effective legal remedies for data subjects are available" — in practice, almost always Standard Contractual Clauses (Commission-approved model clauses) or Binding Corporate Rules for intra-group transfers. Only if neither route is available do the narrow Article 49 derogations apply, and even then only for non-repetitive, limited transfers.

Which countries currently have an EU adequacy decision?

A defined, periodically-reviewed list that currently includes Andorra, Argentina, Brazil, Canada (commercial organisations only), the Faroe Islands, Guernsey, Israel, the Isle of Man, Japan, Jersey, New Zealand, South Korea, Switzerland, the United Kingdom, Uruguay and the United States (only via the Data Privacy Framework, and only for self-certified organisations). The newest addition is Brazil, where the Commission adopted its adequacy decision on 26 January 2026, alongside Brazil’s own mirrored recognition of the EU under its data protection law (LGPD) — a mutual adequacy finding, rather than a one-way EU decision alone. Before any decision, Article 45(2) requires the Commission to assess the rule of law, human rights protections, data protection legislation and independent supervisory authorities in the destination country, and Article 45(3) then requires that assessment to be repeated in a periodic review at least every four years. The list is not static: the Commission can amend, suspend or repeal a decision if a country’s level of protection changes — which is exactly the risk now sitting over the Data Privacy Framework while the Latombe appeal is pending.

Is the EU-US Data Privacy Framework still valid? The Latombe ruling

Yes, for now — the General Court dismissed a challenge to the Data Privacy Framework’s adequacy decision in its entirety on 3 September 2025, but the applicant has appealed to the Court of Justice, so the question is not finally closed. In Case T-553/23, French politician Philippe Latombe sought annulment of Commission Implementing Decision (EU) 2023/1795, arguing that the US Data Protection Review Court (DPRC) created by Executive Order 14086 lacked genuine independence and that US intelligence agencies could still collect data in bulk without prior judicial authorisation, among several pleas raised. On these two central points, the General Court held that "essential equivalence" does not require the third country’s institutional arrangements to be identical to the EU’s, only that they be effective in practice, and it found the DPRC’s appointment rules, for-cause dismissal protections and binding decision-making authority sufficient to meet Article 47 Charter standards — even though the DPRC was created by executive order rather than legislation. On bulk collection, it accepted that ex post judicial review by the DPRC satisfies the Schrems II requirement, without needing prior authorisation before each collection. The Court dismissed the action in its entirety and ordered Latombe to bear the costs. He appealed to the Court of Justice on 31 October 2025 (Case C-703/25 P), which was still pending when this guide was last reviewed.

That pending appeal matters for exam purposes because it is not the first time this exact pattern has played out. The CJEU annulled the original EU-US Safe Harbor framework in Schrems I (2015) and its successor Privacy Shield in Schrems II (2020) — both times after a Commission adequacy decision had already been in force for years. The Data Privacy Framework was built specifically to answer the Schrems II findings, and the General Court’s 2025 judgment in Latombe is the first ruling to test whether it succeeded — but it is only a first instance ruling in this specific case, now under appeal. Whether the Court of Justice reaches the same conclusion once it decides Case C-703/25 P remains genuinely open.

Do you still need SCCs if your US vendor is Data Privacy Framework-certified?

Not legally — the adequacy decision alone is sufficient for a transfer to a self-certified organisation — but it only covers organisations that have actively self-certified, and it is not automatically permanent. A US company must apply to the US Department of Commerce, commit to the Framework’s Principles, and appear on the official Data Privacy Framework List; a vendor that has not done so still needs Standard Contractual Clauses or another Article 46 safeguard, regardless of how the company markets itself. Because the Latombe appeal leaves a real, if uncertain, possibility that the adequacy decision could later be annulled — as happened to both of its predecessors — some organisations keep SCCs in place as a fallback even where DPF certification would be enough on its own; one legal-services FAQ summarising this exact question for in-house counsel puts it plainly: "due to the possibility that DPF could potentially be invalidated… some companies are taking a ‘belt and suspenders’ approach, and are choosing to self-certify under DPF and to continue to rely on SCCs."

What is a Transfer Impact Assessment, and when do you need one?

A documented, case-by-case assessment of whether the destination country’s law and practice undermines the protections in your Standard Contractual Clauses — required whenever you rely on SCCs (or BCRs) rather than an adequacy decision. The requirement comes directly from the CJEU’s Schrems II ruling: contractual clauses alone cannot override a third country’s public authority access powers, so the exporter must check first. The EDPB’s Recommendations 01/2020 set out a six-step methodology — map the transfer, identify the safeguard used, assess whether local law or practice impinges on its effectiveness, identify supplementary measures if needed, take the necessary formal steps, and re-evaluate at appropriate intervals. A transfer relying on an adequacy decision does not need this assessment, because the Commission has already made that determination for the whole country.

When can you use the Article 49 derogations instead?

Only as a fallback for occasional, limited transfers where neither an adequacy decision nor appropriate safeguards are available — not as a routine, repeated transfer mechanism. Article 49(1) lists specific grounds, including explicit informed consent to the transfer, necessity for performing a contract with the data subject, necessity for important reasons of public interest, and necessity to establish, exercise or defend legal claims. Where none of these grounds apply and no other safeguard is available, a narrower residual derogation permits a transfer only if it is not repetitive, concerns a limited number of data subjects, is necessary for compelling legitimate interests that are not overridden by the data subject’s own rights, and the controller has assessed the circumstances and put suitable safeguards around it. Two further steps are separately mandatory, not optional extras: the controller must inform the supervisory authority of the transfer, and must independently inform the data subject of the transfer and of the compelling legitimate interests pursued. EDPB guidance treats Article 49 as an exception to be used sparingly, not a substitute for setting up SCCs when transfers are regular.

Frequently asked questions