Data transfers to the USA under the GDPR

Many common services (Google, Meta, Microsoft, Cloudflare) process data in the USA. Every such transfer needs a basis under Chapter V of the GDPR.

Is this a risk?

Transfers to the US need a basis under Chapter V GDPR. Article 45 may cover eligible recipients with valid DPF certification; otherwise, options include standard contractual clauses with the necessary transfer assessment under Article 46. Other safeguards and the narrow Article 49 derogations require separate assessment. All other GDPR requirements still apply.

What you can do

• Check whether the respective US provider is certified under the Data Privacy Framework.
• Without suitable DPF coverage, assess other appropriate transfer grounds, such as standard contractual clauses and a transfer assessment.
• In the privacy policy, state the recipient country and transfer basis for each service.
• Where possible, choose EU alternatives or EU data centres.

How consentglass helps

The free scan checks the delivered HTML and shows which services are embedded, whether a cookie banner is detected and whether privacy-policy and legal-notice links are present — with context for each finding. It is not a substitute for legal advice.