The General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) sets conditions in Chapter V (Art. 44 to 49) for transferring personal data to countries outside the EU. The Data Act (Regulation (EU) 2023/2854) covers, among other things, switching between cloud services and the protection of non-personal data against unlawful access by non-EU governments. When you choose and buy cloud services, this turns into concrete questions about hosting location, sub-processors, the transfer mechanism and exit terms.
Facts and dates last checked: 11 October 2026 · This page gives general information and is not legal advice; check the text of the Regulations for your situation.
Implementing Decision (EU) 2021/914 adopts the standard contractual clauses (SCCs) as appropriate safeguards under Art. 46(1) and (2)(c) GDPR. The old SCCs were repealed with effect from 27 September 2021; contracts under the old decisions were deemed valid until 27 December 2022 if processing stayed unchanged (Art. 4).
The Commission adopts the adequacy decision for the EU-US Data Privacy Framework (Implementing Decision (EU) 2023/1795, Art. 45 GDPR). On 3 September 2025 the General Court dismissed an action for annulment (T-553/23). An appeal was lodged on 31 October 2025 (C-703/25 P).
The Data Act entered into force. Until 12 January 2027, providers of data processing services may charge only reduced switching charges, not exceeding their direct costs of switching (Art. 29(2) and (3)).
The Data Act applies (Art. 50), including Chapter VI on switching (Art. 23 to 31) and Art. 32 on unlawful access by non-EU governments.
The Commission submits the Digital Omnibus proposal (COM(2025) 837, procedure 2025/0360(COD)). The proposal has not been adopted or published (status 11 October 2026).
Providers of data processing services may no longer impose switching charges (Art. 29(1)).
The GDPR applies to processing of personal data. Chapter V covers transfers to a third country or international organisation, including onward transfers, and applies to controllers and processors (Art. 44). Infringing Art. 44 to 49 can lead to fines of up to 20 million euro or, for an undertaking, 4% of total worldwide annual turnover, whichever is higher (Art. 83(5)(c)).
The Data Act's switching rules (Chapter VI) target providers of data processing services, in practice cloud services. Recital 81 lists IaaS, PaaS and SaaS as delivery models. Custom-built services and services provided as a test version have a lighter regime (Art. 31). Art. 32 concerns non-personal data held in the Union; for personal data the GDPR remains the framework.
A transfer may take place only if the conditions of Chapter V are met, so that the level of protection under the GDPR is not undermined (Art. 44).
Adequacy decision (Art. 45): where the Commission has found an adequate level of protection, no specific authorisation is needed. The Commission's list includes, among others, Switzerland, Japan, the United Kingdom and the Republic of Korea. For the United States the decision covers only organisations that participate in the Data Privacy Framework. The General Court dismissed the action for annulment on 3 September 2025 (T-553/23); an appeal was lodged on 31 October 2025 (C-703/25 P). Follow the case on curia.europa.eu.
Appropriate safeguards (Art. 46): without an adequacy decision there must be appropriate safeguards, with enforceable data subject rights and effective legal remedies. Standard data protection clauses adopted by the Commission are widely used (Art. 46(2)(c)); since 2021 they are laid down in Implementing Decision (EU) 2021/914, with four modules (controller to controller, controller to processor, processor to processor, processor to controller). In Clause 14 the parties warrant that they have no reason to believe that laws and practices in the third country prevent the importer from complying; if appropriate safeguards cannot be ensured, the exporter suspends the transfer. Under Clause 15 the importer must notify the exporter of requests from public authorities, review their legality, challenge them where there are grounds, and provide only the minimum permissible.
Supplementary measures: EDPB Recommendations 01/2020 (version 2.0, 18 June 2021) set out six steps: know your transfers, identify your transfer tool, assess whether the tool is effective in the third country (in practice often called a transfer impact assessment), adopt supplementary measures, take procedural steps, and re-evaluate periodically. The EDPB considers encryption effective where the keys stay solely under the control of the exporter, or of a trusted entity in the EEA or in a jurisdiction offering an essentially equivalent level of protection (Use Case 1). Where a cloud processor needs data in the clear and problematic legislation applies in practice, the EDPB cannot envisage an effective technical measure (Use Case 6). Remote access also counts as a transfer (Use Case 7).
Foreign orders (Art. 48): a judgment or administrative decision of a third country requiring transfer or disclosure is recognised or enforceable only if based on an international agreement, such as a mutual legal assistance treaty. Art. 49 provides derogations for specific situations, such as explicit consent after being informed of the risks.
Processors (Art. 28): a processor does not engage another processor without prior specific or general written authorisation. Under a general authorisation the processor informs the controller of intended changes so that the controller can object (Art. 28(2)). The processor acts on documented instructions, including on transfers to a third country (Art. 28(3)(a)), and remains fully liable for its sub-processors (Art. 28(4)). SCC Clause 9 offers two options: specific prior authorisation, or general authorisation with a list and advance notice.
Providers must remove commercial, technical, contractual and organisational obstacles to switching (Art. 23). This duty applies only to the services, contracts and practices of the provider the customer is leaving (Art. 24).
Art. 25 sets minimum contract terms. The maximum notice period to initiate switching is two months (Art. 25(2)(d)). Switching takes place without undue delay and in any event within a maximum transitional period of 30 calendar days (Art. 25(2)(a)). If that is technically unfeasible, the provider notifies the customer within 14 working days of the request and indicates an alternative period of at most seven months (Art. 25(4)); the customer may extend the transitional period once (Art. 25(5)). The contract also lists all categories of data and digital assets that can be ported (Art. 25(2)(e)), a data retrieval period of at least 30 calendar days (Art. 25(2)(g)), full erasure of exportable data and digital assets generated directly by the customer (Art. 25(2)(h)), the switching charges allowed (Art. 25(2)(i)), and support for the customer's exit strategy (Art. 25(2)(b)).
Switching charges are withdrawn gradually (Art. 29). From 11 January 2024 to 12 January 2027, reduced charges are allowed, not exceeding the costs directly linked to switching. From 12 January 2027 no switching charges may be imposed. Before the contract, the provider must give clear information on standard service fees, early termination penalties and the reduced switching charges (Art. 29(4)), and on services where switching is highly complex or costly or impossible (Art. 29(5)). For in-parallel use of two services, only egress charges that pass on actual costs, without exceeding them, may be imposed (Art. 34(2)).
Technically, an IaaS provider must take reasonable measures to facilitate functional equivalence (Art. 30(1)). Other providers, including SaaS, make open interfaces available (Art. 30(2)) and follow common specifications once published (Art. 30(3)). Exportable data is exported in a structured, commonly used and machine-readable format (Art. 30(5)).
Art. 28: providers publish on their website the jurisdiction to which the ICT infrastructure of each service is subject and a general description of their measures against unlawful non-EU governmental access to non-personal data. Those websites are listed in the contract.
Art. 32: providers take all adequate technical, organisational and legal measures, including contracts, to prevent unlawful third-country access to or transfer of non-personal data held in the Union (paragraph 1). A third-country decision is recognised or enforceable only if based on an international agreement (paragraph 2). Without one, access is possible only under conditions: reasons and proportionality set out, review of an objection by a court in the third country, and account taken of the data provider's legal interests (paragraph 3). The provider gives the minimum amount permissible (paragraph 4) and informs the customer before complying, except for law enforcement requests (paragraph 5).
Use these points in tenders, questionnaires and processor agreements. Where possible, ask for the contract clause and for documentation, not only a statement.
NIS2, DORA and the Cyber Resilience Act cover security, resilience and product security; the GDPR and the Data Act cover where data goes and on what terms. The CLOUD Act is US legislation and is covered separately. Art. 48 GDPR and Art. 32(2) Data Act state from the EU side when an order from a foreign authority can be recognised or enforced.
Digital Omnibus: on 19 November 2025 the Commission submitted a proposal (COM(2025) 837) that concerns, among others, the GDPR and the Data Act. According to the European Parliament's Legislative Observatory (2025/0360(COD)), on 11 October 2026 the proposal has not been adopted or published; the file is at the stage 'awaiting committee decision'. The rules on this page are the rules that apply now.
The score is not an assessment of compliance with the GDPR or the Data Act and does not prove that a vendor complies. The laws do help formulate the questions behind some of the dimensions.
Want to know how your own software stack scores on digital sovereignty? Take the free assessment.
Take the free assessmentNot automatically. Chapter V covers transfers to third countries, including onward transfers (Art. 44), and the EDPB treats remote access as a transfer (Recommendations 01/2020, Use Case 7). Ask about sub-processors and support as well.
SCCs are an appropriate safeguard (Art. 46(2)(c)), but the parties must also assess whether laws and practices in the third country prevent compliance (Clause 14). The EDPB describes six steps in Recommendations 01/2020.
The decision of 10 July 2023 covers only participating US organisations. The General Court dismissed an action for annulment on 3 September 2025 (T-553/23); an appeal was lodged on 31 October 2025 (C-703/25 P).
Not fully. Until 12 January 2027, reduced switching charges not exceeding direct costs are allowed (Art. 29(2), (3)); after that no switching charges may be imposed (Art. 29(1)). For in-parallel use, egress charges may pass on actual costs without exceeding them (Art. 34(2)).
Recital 81 lists SaaS as a delivery model of data processing services. Functional equivalence (Art. 30(1)) applies to IaaS; other services must, among other things, offer open interfaces (Art. 30(2)). Custom-built services and test versions have a lighter regime (Art. 31).
The provision obliges providers to take adequate measures against unlawful third-country access to or transfer of non-personal data held in the Union. Decisions of third-country authorities are recognised only on the basis of an international agreement (paragraph 2) or under the conditions of paragraph 3.
No. According to the Legislative Observatory, the proposal of 19 November 2025 (COM(2025) 837) had not been adopted or published on 11 October 2026.