Data Transfers, GDPR Compliance and US Digital Services: What Is at Stake for Public-Interest Organisations?

This article reflects the law as it stood in September 2025.

I. The Legal and Operational Challenges of Transferring Data to US Providers

When a non-profit's data goes through Google, Microsoft or Adobe, is it really protected?

Karma Com Solidarité (KCS), a French non-profit that brings volunteers' professional skills to non-profits, businesses and local authorities, cares about protecting the data of its volunteers, members, beneficiaries and the organisations it works with. It wants to explain the challenges raised by transferring data to US digital providers. Here is an update on a subject that matters for the non-profit sector and for the public interest.

French public bodies and non-profits rely heavily on external digital services hosted outside Europe for their day-to-day work. The most widely used include Google Workspace (Gmail, Drive, Docs and Meet) and Microsoft 365 (Outlook, Teams, OneDrive and the Office suite). Adobe's products (Acrobat, Creative Cloud) complete a landscape dominated by non-European companies, for essential functions such as email, data storage, collaborative work and document management.

These services often run on infrastructure, or are provided by companies, subject to US law. That raises major questions of compliance with the General Data Protection Regulation (GDPR) whenever personal data is transferred outside the European Union.

A. The GDPR Framework for International Transfers

1. The Basic Principles of Transfers Outside the EU

The GDPR strictly regulates international transfers of personal data. Such a transfer is allowed only on one of three grounds: an adequacy decision, appropriate safeguards, or, in limited cases, a derogation (Article 49). The first requires the destination country to offer a level of protection "essentially equivalent" to that of the European Union.

2. The Legal Instruments Available

Equivalent protection can be established by an adequacy decision of the European Commission, which formally recognises the level of protection in the third country. Without such a decision, appropriate safeguards must be put in place, such as standard contractual clauses (SCCs) or binding corporate rules (BCRs), possibly reinforced by supplementary measures.

3. Sensitive Data in the Public and Public-Interest Sectors

Chapter V does not set stricter transfer rules for particular sectors. What differs is the data: special categories of personal data, such as health data, receive heightened protection under Article 9 of the GDPR, and organisations working in the public, social, cultural, health and social care sectors often process such data. The sensitivity of the data and the public-interest mission of these organisations call for greater vigilance in protecting fundamental rights.

B. The Specific Risks of US Digital Services

1. The EU-US Data Privacy Framework Since 2023

The Data Privacy Framework (DPF) came into force on 10 July 2023. It replaced the Privacy Shield, which the Court of Justice of the European Union (CJEU) struck down in July 2020. The CJEU had invalidated that earlier arrangement because the data of European citizens transferred to the United States was not adequately protected, particularly against US surveillance programmes such as those revealed by Edward Snowden. The new DPF aims to close these gaps: the United States introduced binding safeguards on access to data by its intelligence agencies (Executive Order 14086 of October 2022), including an independent redress mechanism for Europeans (European Commission).

The Data Privacy Framework is therefore the new adequacy decision between the European Union and the United States.

Data can now flow to DPF-certified US companies without further transfer tools, provided the organisation checks carefully that the entity and the data concerned are actually covered by the certification. The framework remains contested: the General Court dismissed an action for annulment on 3 September 2025 (eucrim), and an appeal was subsequently lodged before the Court of Justice. It is therefore essential to consult the official DPF list to make sure that both the service used and the legal entity are covered by the certification.

2. The Alternatives When There Is No DPF Certification

When the Data Privacy Framework does not apply, transfers outside the EU must rely on other legal tools, in particular standard contractual clauses (SCCs) or binding corporate rules (BCRs). These mechanisms call for a careful assessment under the Schrems II judgment (CJEU, 16 July 2020), which requires:

• a concrete analysis of the safeguards offered by the destination country, in particular regarding access to data by public authorities;
• a case-by-case check that the SCCs can actually be complied with in the destination country;
• supplementary measures (encryption, anonymisation, audits) if the legal protections are judged insufficient.

Any assessment of transfers outside the EU must now include a careful evaluation of legal and technical risks, as the 2020 Schrems II judgment requires. In striking down the Privacy Shield, that judgment exposed the weaknesses of the US system with regard to mass surveillance and the lack of effective remedies for European citizens. It requires data controllers to examine, in concrete terms, the legal framework of the destination country and its actual practice on access to data by public authorities.

Given these risks, the supplementary measures mentioned above, such as strong encryption, strict anonymisation of data or specific contractual clauses, become indispensable to secure transfers when the third country's legal safeguards are judged insufficient. This assessment must be documented and reviewed regularly, especially as foreign laws change.

This stricter approach reflects a clear requirement: using standard contractual clauses is no longer enough on its own, unless the organisation can show that the protections it has put in place actually work.

C. Article 48 of the GDPR: A Barrier to Direct Requests from Foreign Authorities

1. No Automatic Recognition of Foreign Decisions

Against this complex legal background, Article 48 of the GDPR provides that a judgment of a court or a decision of an administrative authority of a third country requiring a transfer or disclosure of personal data may only be recognised or enforceable if it is based on an international agreement in force between that country and the European Union or a Member State, without prejudice to other grounds for transfer under Chapter V.

2. The EDPB Guidelines: A Precise Framework

The European Data Protection Board (EDPB) adopted its guidelines on the application of Article 48 on 2 December 2024, for public consultation, and adopted the final version on 4 June 2025. These guidelines point out that any direct request from a foreign authority (tax, judicial, police or other) addressed to a European entity must be examined carefully.

3. The Criteria That Must Be Assessed

The assessment must always cover the legal basis for the request, whether relevant international agreements exist, the specific features of the planned transfer, and the exact role of the processor concerned. These elements make it possible to judge whether the processing complies with the GDPR and to spot possible risks. A careful analysis has become an essential step to prevent disputes or penalties, particularly since data protection authorities have stepped up their checks.

D. Transfer Impact Assessments

1. The CNIL Guide on Transfer Impact Assessments

In 2025, the CNIL, France's data protection authority, published a practical guide (in French) to transfer impact assessments (TIAs), which document that transfers outside the EU comply with the rules. A TIA is needed when the transfer relies on one of the Article 46 tools, such as SCCs or BCRs, including for services that seem ordinary, such as online forms or US collaborative cloud tools. It is not required when the destination country benefits from an adequacy decision, as is the case for DPF-certified US companies, or when the transfer relies on an Article 49 derogation.

2. What a Transfer Impact Assessment Is For

The main aim of a transfer impact assessment is to identify and evaluate the specific risks of transferring data outside the EU, in particular the possibility of unauthorised access or of gaps in protection in the destination country. It checks whether the planned contractual safeguards, such as SCCs, give sufficient protection under the GDPR. Depending on the risks identified, the TIA then recommends technical measures (encryption, anonymisation) and organisational measures (access governance, audits) suited to the level of risk, so that the transferred data is adequately protected.

II. Strategies for Organisations: Alternatives and Data Governance

A. What This Means for Public-Interest Organisations

1. Greater Vigilance Required

These requirements apply to public bodies and public-interest organisations like any other controller. Simply subscribing to a cloud service or a software suite does not guarantee compliance. Every technology choice that involves a data transfer must be assessed, governed and documented methodically.

2. A Deterrent Example: The Uber Fine

A recent penalty shows this clearly. In August 2024, the Dutch Data Protection Authority fined Uber 290 million euros for transferring European drivers' data to the United States, over a period of more than two years, without using a transfer tool (Dutch DPA). The decision is a reminder that every data controller must be vigilant, whatever its legal status or size.

B. Turning to European Solutions: A Credible Alternative

1. Sovereign Solutions as a Strategic Response

Given the regulatory requirements, European solutions and clouds with the SecNumCloud qualification have become a credible alternative. SecNumCloud is a demanding French security qualification issued by ANSSI, the national cybersecurity agency; it requires hosting in the EU, protection against extraterritorial laws and stricter audits. These solutions suit sensitive data in particular (health, biometrics) and core state functions, where sovereignty is paramount. This choice reduces legal risk while providing a high level of security.

2. Weighing Benefits and Risks for Non-European Solutions

When an organisation considers keeping non-European solutions, it must carry out a careful assessment that systematically weighs the operational benefits (features, costs) against the risks (access by foreign states, GDPR compliance). This assessment must document the supplementary measures in place (encryption, anonymisation), while providing for regular review as the legal and technological landscape changes.

C. Rigorous Data Governance: A Compliance Requirement

1. The Foundations of Effective Governance

Organisations that use non-European services need rigorous data governance. It rests on a precise map of data flows, a complete inventory of transfers, and strict contracts in the form of data processing agreements (DPAs). DPAs are contracts required under Article 28 of the GDPR; they set out the roles and obligations of processors (security measures, handling of transfers and so on). Strict compliance with Chapter V of the GDPR, including checking the transfer mechanisms used (SCCs, BCRs), completes the arrangement.

2. Documentation and Traceability: The Central Role of DPAs

Compliance requires thorough documentation, and DPAs are central to it. These contracts record the technical and organisational safeguards imposed on providers (encryption, audits), and they serve as evidence in the event of an inspection. This documentation, which also includes transfer impact assessments and transfer decisions, must be kept up to date, in particular to reflect changes in legal risk (for example, the invalidation of an adequacy mechanism).

III. Conclusion: A Central Issue for Digital Sovereignty

Compliance on international data transfers is now a central issue for digital sovereignty. Every organisation, whether a local authority, a hospital, a non-profit or a social care provider, needs to know exactly where its data goes, under which legal framework it is processed and with what safeguards it is protected.

This demand for transparency and control calls for continuous legal monitoring, rigorous documentation of processes, and a constant balance between digital efficiency and respect for fundamental rights. The stakes go beyond regulatory compliance: they include keeping citizens' trust and helping a European digital ecosystem emerge that respects democratic values.

Article written by Sarah Meillier, legal professional specialising in the GDPR