US cloud and GDPR: Microsoft 365, Google, AWS

May we keep using Microsoft 365, Google Workspace or Amazon Web Services even though data go to the United States? The short answer: yes, as long as the recipient is certified. This article explains what lies behind that answer and what should be documented.

The basis: the adequacy decision

Every transfer of personal data to a third country needs a basis under Chapter V of the GDPR (Art 44 DSGVO). For the United States, since 10 July 2023 that basis has been Implementing Decision (EU) 2023/1795 on the EU-U.S. Data Privacy Framework. It finds that an adequate level of protection exists – but only for transfers to organisations that appear on the Data Privacy Framework List maintained by the U.S. Department of Commerce (Art 1 of the decision, Art 45 DSGVO). It is for the controller itself to check whether a transfer falls within its scope (Art 5 Abs 2 DSGVO).

The list shows for each organisation whether the certification covers HR data and non-HR data. As at 21 October 2026, Microsoft Corporation and Google LLC are actively certified for both categories. Amazon.com, Inc. – according to the list including Amazon Web Services, Inc. – is entered for non-HR data only. For employee data on AWS, the decision therefore provides no basis; standard contractual clauses remain the route for those data.

How stable is the decision?

Its predecessor, the Privacy Shield, was declared invalid by the CJEU on 16 July 2020 (C-311/18, Schrems II) – with no transitional period: the Court did not maintain its effects, because Art 49 DSGVO governs what applies without an adequacy decision and without safeguards under Art 46, and there would therefore be no legal vacuum (para 202).

The new decision has passed its first judicial test: on 3 September 2025 the General Court of the European Union dismissed the action for annulment in Latombe v Commission (T-553/23). It held the rules on the appointment and removal of the judges of the U.S. review court (Data Protection Review Court) to be sufficient (para 57), assessed the legal position as it stood when the decision was adopted (para 22) and, for later changes, pointed to the Commission's duty to suspend, amend or repeal the decision (para 58). The appeal C-703/25 P has been pending before the CJEU since 31 October 2025; as at October 2026 there had been neither an Advocate General's opinion nor a hearing date.

The Commission carried out the first review of the framework in July 2024; its report of 9 October 2024 (COM(2024) 451 final) provides for the next review after three years. The staffing of the five-member oversight body PCLOB, whose website lists a single member in October 2026, remains open; whether that affects adequacy has not been decided.

The fallback: standard contractual clauses plus assessment

If the decision ceases to apply or certification is lacking, the Commission's standard contractual clauses remain available (Implementing Decision (EU) 2021/914, Art 46 Abs 2 lit c DSGVO). They are not sufficient on their own: under Clause 14 the parties must assess whether the law of the destination country – including the access powers of public authorities – prevents the importer from complying with the clauses, document that assessment and make it available to the supervisory authority on request. The CJEU imposed this assessment (transfer impact assessment) on the data exporter in Schrems II: assess case by case, adopt supplementary measures where necessary, otherwise suspend the transfer (paras 134 and 135).

The Google Analytics case shows how strictly this is handled in Austria: for a website visit in August 2020 – after Schrems II, before the new decision – the Data Protection Authority found that standard contractual clauses together with the supplementary measures offered at the time did not provide an adequate level of protection; the operator did not challenge that. The Federal Administrative Court (Bundesverwaltungsgericht) shared this assessment in its judgments of 12 May 2023, W245 2252208-1 and W245 2252221-1: the infringement of Art 44 DSGVO is attributable to the operator as data exporter, not to the U.S. provider, which Chapter V does not bind directly. The Supreme Administrative Court (Verwaltungsgerichtshof) confirmed this on 1 September 2026 (Ro 2023/04/0025): Art 44 DSGVO is addressed to whoever decides on the transfer or carries it out on behalf of another – not to the recipient in the third country, even if it subsequently processes the data as controller or processor (para 40). The data subject can therefore obtain a finding that the transfer was unlawful only against the exporter (para 46); the court saw no need for a reference to the CJEU, because the wording left no room for doubt (para 47). The decision concerns the legal position before the Data Privacy Framework; the allocation of responsibility, however, applies irrespective of it: whoever transfers is answerable for the basis.

Storage location in the EU and the CLOUD Act

A storage location in the EU reduces transfers but does not release the provider from U.S. law: under 18 U.S.C. § 2713 (CLOUD Act), an order under U.S. law also covers data that a U.S. provider holds outside the United States in its possession, custody or control. Art 48 DSGVO sets a limit to this: such an order may – without prejudice to other grounds for transfer under Chapter V – be recognised or enforceable only if it is based on an international agreement such as a mutual legal assistance treaty. According to the European Data Protection Supervisor, Microsoft's "EU Data Boundary" is also subject to exceptions under which data leave the EU.

The EDPS's proceedings concerning the Commission's use of Microsoft 365 show how risks can be contained by contract: the infringements found on 8 March 2024 were considered remedied on 11 July 2025 after the types of data, the purposes, the permitted recipients and destination countries, and the notification of disclosure requests had been settled with Microsoft. The Commission is subject to Regulation (EU) 2018/1725, not the GDPR; the mechanism corresponds to the documented instruction under Art 28 Abs 3 lit a DSGVO.

What you should keep on file

• Data processing agreement (Art 28 Abs 3 DSGVO) including the instruction on third-country transfers (lit a) and the authorisation of sub-processors (Abs 2), with the date and version of the provider's terms.
• Transfer basis per service: an extract from the Data Privacy Framework List with date and data category, or standard contractual clauses together with the documented assessment under Clause 14 – both in the record of processing activities (Art 30 Abs 1 lit d and e DSGVO).
• Privacy notice and employee information (Art 13 Abs 1 lit e and f DSGVO): recipients, third country, adequacy decision or safeguards, with a reference to where they can be consulted.
• Data protection impact assessment only where a high risk is likely (Art 35 DSGVO) – for example health data on a large scale or tools using artificial intelligence (DSFA-V § 2); cloud use as such does not trigger it.
• Plan B: check whether the provider's terms already contain the standard contractual clauses as a fallback basis, and prepare the assessment under Clause 14. In 2020 there was no transitional period for that.
• Keep watching: the appeal C-703/25 P and the Commission's next review in 2027.

This information is general in nature and does not replace advice on an individual case.