Standard contractual clauses: data sent outside Europe

The rule

The chapter then gives the sender a ladder. The first rung is an adequacy decision under Article 45, after which a transfer “shall not require any specific authorisation.” Without one, Article 46 applies.

Article 49 sets out narrow derogations, such as explicit consent after being told the risks. They apply only “in the absence of” an adequacy decision or appropriate safeguards.

Two sources shape how this is read. In Schrems II (C-311/18, 16 July 2020) the Court of Justice invalidated the EU-US Privacy Shield and upheld standard contractual clauses, with the exporter responsible for checking that they work in the destination country. The EDPB’s Recommendations 01/2020 turn that into six steps, from knowing your transfers to re-evaluating at intervals. The EDPB also notes in a footnote that remote access from a third country to data held in the EEA is a transfer.

The United States is the destination most websites meet. On 10 July 2023 the Commission adopted an adequacy decision for the EU-US Data Privacy Framework. The EDPB’s information note says it covers organisations “included in the ‘Data Privacy Framework List’” kept by the US Department of Commerce, so a transfer to a listed organisation needs no Article 46 tool and no supplementary measures, while a transfer to an unlisted one does. On 3 September 2025 the General Court dismissed an action to annul the decision (T-553/23, Latombe v Commission), finding that the United States ensured an adequate level of protection on the date the decision was adopted. The press release notes that an appeal on points of law is possible.

What PeekWell checks and how

EU-06 puts two observations side by side: where the page sends visitor data, and what the privacy policy says about it. It does not decide whether a transfer is covered. It writes down whether the policy names a mechanism.

The scan opens a public page in a clean browser and records every network request. It resolves the domains and addresses to a hosting location and flags requests that look like they carry visitor data to places outside the EU and outside the countries with adequacy decisions. The policy fetcher then reads your privacy policy, and a language model checks whether the transfer section names a mechanism: an adequacy decision, the Data Privacy Framework, standard contractual clauses or binding corporate rules. The report states the pairing, for example “data sent to a US endpoint; policy names no transfer mechanism”. The decision that the two did not match is made by code from that evidence. The model reads and explains, and never decides that a finding exists.

The method matches EU-04, which finds recipients the policy does not name. EU-06 adds where the recipient sits and the safeguard sentence. EU-08 covers the other Article 13 items.

The scan has limits, and the report says so. It sees the public pages it visited and nothing behind a sign-in. It does not submit forms, test passwords or open addresses nobody linked to. An address that resolves to a server in one country does not say who the legal recipient is, and content delivery networks answer from nearby servers. Whether a vendor sits on the Data Privacy Framework List, and what a signed contract says, are things the browser cannot see. Collection that happens on a server or inside an app is outside a browser visit. A Passed means the expected behaviour was observed on the pages scanned. It does not say the site complies.

Why it matters for a company

The first reason is the size of the record. In the Meta Ireland decision the DPC found that transfers continued after Schrems II on the 2021 clauses plus supplementary measures, and that this did not address the risks the Court of Justice had named. The fine was EUR 1.2 billion, reflecting a binding decision of the EDPB, and the order required future transfers to be suspended. In the Uber decision the issue was simpler: for over two years drivers’ data, including identity documents and location data, went to the US headquarters with no transfer tool in use. The TikTok decision reached remote access from China.

The second reason is the paperwork. The TikTok decision found the 2021 privacy policy did not name China and did not explain that the processing included remote access by staff there. The disclosure was a finding in its own right, separate from the transfers.

The third is that the duty sits with the sender, not the vendor. In the Caffeina Media decision the company said it had no ability to negotiate with Google, to see what data went where or to check Google’s technical measures. The Garante took that imbalance into account in assessing the company’s conduct, and still cited Articles 44, 46 and 13(1)(f). That decision predates the current EU-US framework, so it shows how authorities reason about a vendor the sender cannot inspect, not how a Data Privacy Framework listing would be treated today.

Smaller companies and larger companies

The rule has no size threshold. What differs is how the gap comes about.

In a small company the transfer usually arrives with a tool. A marketer adds analytics, a chat widget, a video embed and an email service. Each vendor has its own answer to whether it is listed, on clauses, or neither. The privacy policy came from a generator before the tools were added, and nobody holds the list of vendors. In Italy a single analytics tool on a magazine site led to a complaint and a formal warning.

In a larger company the problem is scale and change. Data moves between group entities, support teams and cloud regions, sometimes by remote access rather than copying, which still counts, as the EDPB footnote and the TikTok decision show. Contracts on the older clauses had to be replaced: Decision 2021/914 let them stand only until 27 December 2022, and only while processing stayed unchanged.

How to fix it

1. List what leaves. Open your site in a private window with the browser’s network tab open and write down every third-party domain that receives requests. Add tools that do not show up there, such as your email platform and support desk. Mark which receive personal data, including IP addresses and cookie identifiers.
2. Find where each recipient sits. Ask each vendor, or read its data processing terms, for the countries where it and its sub-processors handle the data. Include remote access by staff or group companies elsewhere, because the EDPB treats that as a transfer.
3. Name the tool for each. For a US vendor, check the Data Privacy Framework List and keep a dated copy of the entry. For any vendor that is not covered by an adequacy decision, make sure a signed set of the Commission’s 2021 standard contractual clauses is in place, or binding corporate rules inside a group. Contracts that still use the older clauses should be replaced.
4. Assess where clauses are the tool. The EDPB’s step three asks you to look at the destination’s law and practice for your specific transfer and, if needed, add supplementary measures. Keep a short written note of what you decided. If you cannot do this, a vendor hosting inside the EU is an option.
5. Write the sentence in your privacy policy. For each destination, name the country, say whether it rests on an adequacy decision or on safeguards, and say how a visitor can get a copy of those safeguards, as Article 13(1)(f) asks. Update it when a tool is added or removed.
6. Re-scan. Run a scan again after the change. EU-06 should show the policy naming a mechanism for each destination the page reached.

Whether a particular transfer is covered is a question for your legal adviser, and Peeky reports only what it sees.