Yes, an EU organisation can use US software and remain GDPR-compliant, but an EU hosting region alone is not enough. You must classify the data, map every transfer and access route, choose a valid GDPR Chapter V transfer mechanism, sign a controller–processor agreement, and constrain provider access with technical and organisational controls.
The practical test is not “Where is the main database?” It is “Which personal data can leave the European Economic Area, who can access it, for what purpose, under which legal safeguard, and can we prove that the arrangement remains controlled?”
As an Amazon Associate I earn from qualifying purchases.
EU residency is not the same as keeping data inside the EU
“Data residency” usually means choosing an EU storage or processing region. GDPR compliance is broader. Personal data can be transferred internationally through primary storage, replicas, backups, disaster-recovery systems, customer-support tools, telemetry, subprocessors, administrator sessions, logs, exports and remote troubleshooting.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesA service may store production records in Germany or Ireland while allowing a support engineer in the United States to view an incident transcript, sending diagnostics to a US analytics service, or replicating backups outside the EU. Each route needs to be identified and assessed. An EU region reduces exposure and can help with latency and policy requirements, but it does not automatically remove Chapter V transfer obligations.
There is no universal GDPR rule requiring a fixed percentage of an organisation’s data to remain in Europe. The primary legal sources describe transfer mechanisms and safeguards, not a single EU-wide residency quota. National, sector-specific or contractual rules may still impose stricter requirements, so those requirements must be checked separately.
What the EU–U.S. Data Privacy Framework does—and does not do
It can provide an Article 45 transfer route
On 10 July 2023, the European Commission adopted an adequacy decision for the EU–U.S. Data Privacy Framework (DPF). Personal data can flow from the EU to US companies that participate in the framework, subject to the scope of the decision and the organisation’s certification. The implementing decision says transfers to certified US organisations may occur without further authorisation.
Before relying on DPF, verify the provider’s current listing, the exact US legal entity, and the services and data categories covered. A parent company’s certification does not automatically cover every affiliate, product or subprocessors’ service. Certification is a status to recheck, not a permanent assumption.
Free tools Windows power users keep installed
One-click scans. No signup required.
DPF is not a general GDPR-compliance badge
The programme’s official FAQ states: “It is important to note that the EU-U.S. DPF is not a GDPR compliance mechanism,” but a mechanism that helps participating organisations meet EU requirements for transferring personal data to third countries. You still need a lawful processing basis, purpose limitation, minimisation, security, retention, transparency and data-subject rights procedures.
The GDPR continues to apply whenever its territorial-scope conditions are met. The EU implementing decision does not turn a US SaaS product into a GDPR-complete service; it addresses one part of the international-transfer analysis.
DPF does not automatically solve onward transfers
The DPF onward-transfer principle requires a contract when EU personal data is sent to a processor for processing, even if that processor does not participate in DPF. The contract must state the customer’s instructions, the processor’s technical and organisational measures, and conditions for further transfers. Your review must therefore include the vendor’s subprocessors and service providers, not only the primary vendor’s DPF status.
Why Schrems II still matters to your assessment
On 16 July 2020, the Court of Justice of the European Union invalidated the previous EU–US Privacy Shield decision in the Schrems II judgment. The decision highlighted the need to address risks related to access by US public authorities. The current DPF adequacy decision records that background and the safeguards introduced in response.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallFor a customer, the practical lesson is to document the actual data flows and the safeguards that apply to them. Do not describe a transfer as “safe because the vendor is American” or “safe because the server is in the EU.” Record the legal route, the provider’s commitments, access controls, encryption arrangements, support model and any residual risk. If a transfer is not covered by DPF, identify another Chapter V mechanism—often Standard Contractual Clauses (SCCs)—and complete the organisation’s transfer-impact analysis where required by its compliance process.
A six-step implementation sequence
1. Classify what the SaaS product will receive
Start with a data inventory, not with a list of cloud regions. Separate the information into categories that drive different decisions:
- Personal data: names, identifiers, contact details, account records, device identifiers, support conversations and other information relating to an identified or identifiable person.
- Special-category data: information that receives heightened protection under GDPR and may justify keeping the data out of a general-purpose SaaS product unless the use is necessary and properly controlled.
- Confidential business data: source code, contracts, financial forecasts, security information and other material that may not be personal data but still requires strict access and retention controls.
- Data that can stay out of the service: fields that can be removed, aggregated, pseudonymised or anonymised before upload.
Write down the purpose for each field and the minimum retention period. If a workflow only needs a customer reference number, do not send a full identity profile. Pseudonymisation reduces exposure but does not make information anonymous when your organisation retains the key or can reconnect the records.
2. Map every path the data takes
Ask the vendor for an architecture and subprocessor description, then verify it against your configuration. Your map should include the following paths:
| Flow to document | Questions to answer | Evidence to retain |
|---|---|---|
| Primary storage and processing | Which EU region hosts the tenant? Is processing performed in the same region? | Service-region selection, product documentation and contract language |
| Backups and disaster recovery | Where are snapshots, replicas and recovery environments located? How long are they retained? | Backup policy, recovery design and retention settings |
| Administrator and support access | Can staff outside the EEA view content or metadata? Is access approved, time-limited and logged? | Access policy, role model, support procedure and audit logs |
| Telemetry and diagnostics | Do usage events, error reports, IP addresses or message contents go to another country? Can optional collection be disabled? | Telemetry settings, data dictionary and vendor response |
| Subprocessors | Which entities handle hosting, support, analytics, email, security or payments, and from which countries? | Current subprocessor list, notice process and approval records |
| Exports and integrations | What leaves the service through APIs, webhooks, downloads or connected applications? | Integration inventory, destination list and deletion procedure |
Treat metadata as a potential personal-data flow. An IP address, user identifier, ticket transcript or administrator log can identify a person even when the main business record is not exported.
3. Determine the transfer mechanism for each flow
For every non-EEA route, record the legal mechanism and the scope it covers.
- DPF adequacy: applicable when the receiving US legal entity is currently certified and the particular service and data flow fall within that certification.
- SCCs or another Chapter V safeguard: use the route required by your circumstances when DPF does not cover the recipient or the flow.
- Documented risk analysis: assess the law and practice affecting the destination, the type and sensitivity of data, the possibility of government access, and the supplementary controls that reduce risk.
Do not use one blanket statement such as “the vendor has SCCs.” Identify the module, parties, data categories, purposes, destinations, subprocessors and technical measures. If one telemetry provider is outside the DPF scope, that separate flow needs its own treatment even when the main SaaS tenant is covered.
4. Put the processing terms in a controller–processor contract
Execute a GDPR-compliant data-processing agreement (DPA) before production use. At minimum, the agreement should address:
- documented instructions, purposes, data categories and duration;
- confidentiality and appropriate technical and organisational measures;
- assistance with access, correction, deletion, restriction, portability and other data-subject requests;
- breach notification and cooperation with investigations;
- subprocessor appointment, advance notice, objection rights and flow-down obligations;
- return or secure deletion at the end of service, including backups where technically feasible;
- audit information, independent assurance reports and a way to verify compliance; and
- onward-transfer conditions that apply even when a downstream processor is not DPF-certified.
Make the DPA, SCCs and product terms consistent. A marketing statement about “EU hosting” cannot override a contract that permits global support access or unrestricted diagnostic transfers.
5. Restrict access with technical and organisational controls
Choose controls that address the actual paths in your map:
- Least privilege: separate customer administrators, vendor support and emergency roles; grant only the permissions needed for each task.
- Geographic and approval controls: use EU-based support or administration when offered, require approval for exceptional access, and set automatic expiry for temporary permissions.
- Strong authentication: enforce phishing-resistant multi-factor authentication for customer and privileged accounts.
- Encryption: encrypt data in transit and at rest. Where the service supports customer-managed keys or an equivalent arrangement, determine who controls key creation, rotation, revocation and recovery.
- Logging: record administrative access, exports, configuration changes and support sessions; send logs to a controlled monitoring system and define retention.
- Minimisation and retention: disable optional telemetry, remove unused fields, mask sensitive values in support tickets and automatically delete data when the purpose ends.
- Segmentation: keep special-category or highly confidential information out of a general SaaS tenant unless the additional controls and legal basis are documented.
Encryption does not automatically eliminate a transfer. If the provider can decrypt the data, or can access keys or plaintext during support, that access remains part of the assessment. Customer-controlled keys can reduce provider visibility, but only if the implementation prevents the provider from obtaining the key and still meets the application’s operational needs.
6. Reassess at renewal and after material changes
Set a review trigger for contract renewal, a new product module, a new subprocessor, a region change, a major support-model change, a security incident or a change in transfer law. Recheck:
- the provider’s current DPF listing, legal entity and covered services;
- storage, processing, backup and disaster-recovery locations;
- subprocessors and their countries;
- government-request and transparency information;
- support and administrator access routes;
- telemetry defaults and retention settings; and
- your deletion, export and key-management controls.
The EDPB’s business FAQ version 2.0 was published on 23 January 2026. Use the current edition when updating internal guidance rather than relying on an older checklist. Regulatory and contractual conditions can change between annual reviews, so material changes should trigger an earlier reassessment.
How to compare US SaaS products
Use a weighted review rather than treating “EU region available” as a pass/fail answer.
| Decision axis | What to verify | Red flags |
|---|---|---|
| Transfer basis | DPF certification or a documented SCC/other Chapter V route for every flow | Certification applies only to a parent company, or telemetry and support are omitted |
| Geography | EU processing, backups, replicas and recovery locations | “EU hosting” is stated without backup or disaster-recovery detail |
| Access control | Countries from which support and administration occur; approval, expiry and logging | Standing global administrator access or unlogged support sessions |
| Provider transparency | Subprocessor list, government-request process, audit evidence, incident notice and change notification | No current list, vague notice terms or no evidence suitable for your risk |
| Customer control | Key ownership, export, deletion, retention and telemetry settings | Cannot disable unnecessary collection or verify deletion |
| Operational fit | Required features, latency, support coverage and migration cost | Compliance controls make the service unusable or force duplicate systems |
Record the reason for selecting the service and the controls that make the decision acceptable. This creates an evidence trail for procurement, security review and supervisory-authority questions.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Common mistakes and how to correct them
“The server is in the EU, so there is no transfer”
Why it fails: remote access, support tooling, backups, telemetry or subprocessors can still send or expose personal data outside the EEA.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Correction: map each route, identify the recipient and country, and apply a Chapter V mechanism wherever required.
“The vendor is DPF-certified, so GDPR is covered”
Why it fails: DPF addresses international transfers, not all GDPR duties. The programme’s own FAQ expressly distinguishes the transfer mechanism from GDPR compliance.
Correction: complete the processing-purpose, security, retention, rights and accountability work separately, and verify that the certification covers the entity and service you use.
“The contract mentions SCCs, so no further analysis is needed”
Why it fails: SCCs must describe the real parties, modules, destinations and safeguards. A generic clause may not cover a support vendor or analytics subprocessor.
Recommended Free Tools
Correction: maintain a transfer register and risk analysis for each route, then align the DPA, SCCs, subprocessor terms and technical configuration.
Best Value
“Telemetry is harmless because it is not customer content”
Why it fails: identifiers, IP addresses, user actions and error traces may be personal data and may reveal confidential information.
Correction: ask exactly what is collected, where it goes, how long it remains, whether it can be disabled or minimised, and which legal mechanism covers the destination.
“One review at procurement is enough”
Why it fails: vendors add subprocessors, change regions, alter support operations and update certifications.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Correction: monitor change notices and set formal reassessment triggers at renewal and after material service changes.
A practical approval checklist
Before approving a US SaaS service that will handle EU personal data, confirm that the file contains:
- A data classification and field-level minimisation decision.
- A current flow map covering production, backups, support, telemetry, subprocessors and exports.
- The verified DPF listing and covered legal entity and services, or the selected alternative Chapter V safeguard.
- A completed transfer-impact or equivalent documented risk analysis where your mechanism requires it.
- A signed DPA with instructions, security, rights assistance, subprocessors, deletion, audit and onward-transfer terms.
- Configuration evidence for EU regions, retention, telemetry, encryption, keys, authentication and logging.
- A written exception process for non-EU support or emergency access.
- An owner and date for the next review, plus triggers for earlier reassessment.
What EU institutions’ cloud investigations show
The European Data Protection Supervisor’s annual report describes investigations into cloud use by EU institutions, including services from Microsoft and Amazon Web Services. The focus was Chapter V compliance when data is transferred to non-EU countries, including the United States. The lesson for private organisations is practical: selecting a large or familiar provider does not replace documenting transfers, safeguards and access controls.
Use this decision rule
Approve a US software service only when you can explain, in writing, every personal-data path; identify a valid Chapter V route for each non-EEA recipient; bind the vendor and subprocessors to enforceable processing terms; and demonstrate controls over access, keys, telemetry, retention, deletion and change management. An EU region is a useful control within that package, not a substitute for it.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
