Can EU companies use US cloud providers under GDPR?
Yes. The GDPR does not prohibit US cloud providers and does not require personal data to be stored in the EU. It requires a data processing agreement with the provider and a legal basis under Chapter V for every transfer of personal data to the US, which includes remote access by US staff. Today that basis is either the EU-US Data Privacy Framework, for providers certified under it, or standard contractual clauses with a transfer impact assessment. The remaining risk is legal instability: the two previous EU-US frameworks were struck down by the EU Court of Justice in 2015 and 2020.
What the GDPR requires from a cloud setup
Three parts of the GDPR apply to any cloud provider, US or not:
- Article 28: a contract (the data processing agreement) that binds the provider to process data only on your instructions and to use sub-processors only with your authorization.
- Article 32: appropriate technical and organizational security measures, such as encryption, access control and tested backups.
- Chapter V (Articles 44 to 50): rules for transfers to countries outside the EU and EEA.
Choosing an EU region does not take a US provider out of Chapter V. The European Data Protection Board considers remote access from a third country, for example by a support engineer, to be a transfer (EDPB Guidelines 05/2021). The steps to keep data and access inside the EU are in how to keep cloud and Kubernetes data inside the EU.
Transfer tools for US providers
| Tool | How it works | Conditions |
|---|---|---|
| EU-US Data Privacy Framework (DPF) | The Commission’s adequacy decision, Implementing Decision (EU) 2023/1795 of 10 July 2023, treats certified US companies as providing adequate protection | The provider and every relevant US sub-processor must be on the DPF list |
| Standard contractual clauses (SCCs) | Contract terms adopted by the Commission in Implementing Decision (EU) 2021/914 | A transfer impact assessment and, where needed, supplementary measures under EDPB Recommendations 01/2020 |
| Binding corporate rules | Approved internal rules for transfers within a corporate group | Mostly relevant for transfers inside your own group |
Most cloud contracts include both: DPF certification as the primary basis and SCCs as a fallback if the DPF falls.
Why the legal basis could change
The legal history explains why companies plan for a fallback:
- October 2015: the Court of Justice invalidated the Safe Harbor framework in Schrems I (C-362/14).
- July 2020: it invalidated the Privacy Shield in Schrems II (C-311/18), finding that US surveillance law, in particular Section 702 of FISA, was not limited to what is strictly necessary and lacked effective redress.
- July 2023: the Commission adopted the DPF, based on new US safeguards including a Data Protection Review Court for EU complaints.
- 3 September 2025: the EU General Court dismissed the first annulment action against the DPF, brought by French MP Philippe Latombe (T-553/23).
- 31 October 2025: Latombe appealed to the Court of Justice (Case C-703/25 P). As of November 2026 the appeal is pending.
A ruling against the DPF would remove the adequacy basis overnight, as happened in 2020. Transfers would then depend on SCCs plus supplementary measures, which the EDPB considers hard to make effective when a provider must hand over readable data to US authorities.
Where the CLOUD Act fits
The DPF addresses US intelligence access to data. Law enforcement requests under the US CLOUD Act are a separate channel: a US provider can be ordered to disclose data it controls in any country, and Article 48 of the GDPR does not recognize such orders without an international agreement. That conflict exists regardless of the DPF. See does the US CLOUD Act apply to data stored in the EU.
What teams typically do
This describes common practice, not legal advice for a specific case.
| Measure | Purpose |
|---|---|
| Use EU regions for personal data | Reduces the volume of transfers and simplifies the assessment |
| Check DPF certification of the provider and its sub-processors | Confirms the adequacy decision applies |
| Keep SCCs in the data processing agreement | Keeps a legal basis if the DPF is invalidated |
| Document a transfer impact assessment | Required for SCCs, and useful evidence for supervisory authorities |
| Encrypt with keys held outside the provider | A supplementary measure: data handed over without the key stays unreadable |
| Keep personal data out of logs, tickets and support exports | Limits what remote access can expose |
| Keep an exit plan for sensitive systems | Shortens the response if the legal basis changes |
Organizations with sensitive data or low risk tolerance often go further and place those systems with a provider outside US jurisdiction. That is a risk decision, not a GDPR requirement; the steps are in how to migrate from a US hyperscaler to a European cloud.
Cloudfleet and the GDPR
Cloudfleet offers a Data Processing Agreement with a list of all sub-processors, and all staff with production access are located in Germany, as described in Security and data protection. Control planes run on Google Cloud infrastructure, and Confidential Control Plane on Enterprise clusters keeps the keys that encrypt cluster data in your own HSM or cloud KMS, a common supplementary measure after Schrems II.