| Myth | Reality |
|---|---|
| Privacy Shield was replaced once and the problem is solved for good. | Privacy Shield’s successor, the EU-US Data Privacy Framework, is already facing fresh legal challenges from noyb, with a CJEU ruling plausible in the 2026-2027 window. |
| Standard Contractual Clauses alone are enough to legalize a transfer. | Since Schrems II, SCCs must be paired with a documented Transfer Impact Assessment evaluating the destination country’s surveillance laws and practical enforceability. |
| Only companies with EU operations need to worry about this. | Any organization processing EU residents’ personal data, including US companies with no EU office, is bound by these transfer rules if GDPR’s extraterritorial scope applies to their processing. |
| Binding Corporate Rules are a quick fix for urgent transfer needs. | BCRs typically take 12-18 months or longer to gain regulatory approval through the EDPB consistency mechanism, making them a long-term structural solution rather than a fast option. |
How We Got Here: From Safe Harbor to Schrems II
The current landscape of cross-border data transfer mechanisms cannot be understood without its litigation history. The original EU-US Safe Harbor framework was invalidated by the Court of Justice of the European Union (CJEU) in 2015 following a complaint by Austrian privacy activist Max Schrems (Schrems I), on the grounds that US surveillance law did not provide protections equivalent to EU standards. Its replacement, Privacy Shield, lasted only a few years before the same court struck it down again in July 2020 in Schrems II, for essentially the same underlying reason: US intelligence-gathering programs, including those authorized under Section 702 of FISA and Executive Order 12333, allowed government access to data transferred from the EU without providing EU data subjects with an enforceable right to redress equivalent to what GDPR requires.
Schrems II did more than strike down Privacy Shield. It also placed a new, practical burden on the fallback mechanism many companies had already been using: Standard Contractual Clauses. The court ruled that SCCs remain valid in principle, but that data exporters cannot rely on them blindly — they must independently verify, on a transfer-by-transfer basis, that the destination country’s laws do not undermine the contractual protections the SCCs are supposed to provide. If they do, the exporter must implement supplementary measures or, failing that, suspend the transfer.
Mechanism One: The EU-US Data Privacy Framework
The EU-US Data Privacy Framework (DPF) was adopted by the European Commission in July 2023 as an adequacy decision — a determination that certified US organizations provide protection essentially equivalent to the GDPR. Unlike SCCs, an adequacy decision does not require transfer-by-transfer risk assessment; once a US company is certified under the DPF, transfers to it are treated as if they were transfers within the EU itself.
The DPF addressed the specific defects the CJEU identified in Privacy Shield by introducing new limitations on US signals intelligence collection (limiting it to what is “necessary and proportionate”) and creating a two-tier redress mechanism for EU individuals, including a newly established Data Protection Review Court within the US Department of Justice. As of mid-2026, the DPF remains the primary transfer mechanism for certified companies, but it is not settled law. Privacy advocacy group noyb — the organization founded by Max Schrems himself — has filed fresh legal challenges arguing the underlying surveillance concerns were never fully resolved, and these challenges are progressing through EU courts, with observers considering a CJEU ruling plausible in the 2026-2027 timeframe. Given that both of the DPF’s predecessors were eventually struck down, most legal advisors now recommend against relying on the DPF as a sole transfer mechanism.
| Mechanism | Basis | Transfer-specific assessment required? | Current legal status |
|---|---|---|---|
| EU-US Data Privacy Framework | European Commission adequacy decision | No, if the recipient is certified | Valid, but under fresh legal challenge from noyb |
| Standard Contractual Clauses | Pre-approved contract clauses under GDPR Article 46 | Yes, Transfer Impact Assessment required post-Schrems II | Valid; the default fallback mechanism |
| Binding Corporate Rules | Internal group-wide data protection rules approved by a lead supervisory authority | Not per-transfer, but requires upfront regulatory approval | Valid; increasingly favored for large multinational groups |
| Derogations (Article 49) | Narrow exceptions such as explicit consent or contractual necessity | Case-by-case, intended for occasional, non-repetitive transfers | Valid but narrowly interpreted by regulators |
Mechanism Two: Standard Contractual Clauses and the Transfer Impact Assessment
Standard Contractual Clauses remain the most widely used transfer mechanism precisely because they do not depend on the political durability of an adequacy decision. The European Commission published a modernized, modular set of SCCs in 2021 covering controller-to-controller, controller-to-processor, processor-to-processor, and processor-to-controller scenarios. Companies embed these clauses directly into data processing agreements with vendors and partners outside the EEA.
What changed after Schrems II is the due diligence obligation layered on top of the clauses themselves. A Transfer Impact Assessment (TIA) requires the exporter to evaluate: the nature of the data being transferred, the legal and practical accessibility of that data to public authorities in the destination country, and whether “supplementary measures” — technical (such as strong encryption where the importer has no access to keys), contractual, or organizational — can close any gap between the destination country’s actual protections and the level GDPR requires. If a meaningful gap remains and cannot be closed, the exporter is legally required to suspend the transfer, not merely to document the risk and proceed anyway.
In practice, most organizations conducting a TIA for US-bound data transfers document the existence of FISA Section 702 and similar authorities, assess the likelihood that the specific data category and recipient would be targeted (a factor that varies enormously between, say, a payroll processor and a telecommunications company), and apply supplementary measures like end-to-end encryption or pseudonymization to reduce exposure. This is one of the clearest practical links between transfer strategy and data protection technique: a well-pseudonymized dataset, with the key held exclusively in the EU, is a textbook supplementary measure that can materially strengthen a TIA’s conclusion, a point covered further in anonymisation versus pseudonymisation.
Layering mechanisms as a hedge
A multinational SaaS company processes EU customer data through a US-based subsidiary. Rather than relying solely on the company’s Data Privacy Framework certification, its legal team also executes Standard Contractual Clauses with the subsidiary and completes a Transfer Impact Assessment, encrypts data in transit and at rest with EU-held keys, and maintains Binding Corporate Rules covering intra-group transfers to other affiliates. If the DPF is struck down by a future CJEU ruling, as both of its predecessors were, the SCCs and supplementary measures continue to provide a valid legal basis for the transfer without requiring an emergency migration.
Mechanism Three: Binding Corporate Rules
Binding Corporate Rules (BCRs) are internal, legally binding data protection policies adopted by a corporate group for transfers between its own entities across borders. Unlike SCCs, which govern a bilateral relationship, BCRs cover an entire multinational group at once, making them well suited to companies with dozens of intra-group data flows spanning many countries. A company applies to a single “lead” supervisory authority, which then coordinates review with other concerned authorities under the GDPR’s Article 63 consistency mechanism, ultimately requiring a formal opinion from the European Data Protection Board before approval.
BCRs have historically been criticized for their slow approval timelines, often 12-18 months or longer for a first-time application. The EDPB has been actively working to streamline this: an updated cooperation procedure was published in March 2025 to shorten approval timelines, and in January 2026 the EDPB published draft Recommendations updating Processor BCRs (BCR-Ps) specifically, open for consultation until March 2026. These updates matter because Processor BCRs — used by cloud and service providers processing data on behalf of client controllers — are a growing category as more infrastructure providers seek a stable, adequacy-independent transfer basis for their global operations.
| Factor | Standard Contractual Clauses | Binding Corporate Rules |
|---|---|---|
| Best suited for | Transfers to unrelated third parties (vendors, partners) | Intra-group transfers within a single multinational company |
| Setup time | Weeks, once a Transfer Impact Assessment is complete | Typically 12-18 months or more for regulatory approval |
| Ongoing maintenance | Per-transfer TIA review as circumstances change | Periodic internal audits and EDPB-aligned updates |
| Regulatory dependency | Low — clauses are pre-approved by the European Commission | High — requires ongoing supervisory authority relationship |
Mechanism Four: The Narrow Derogations
GDPR Article 49 provides a set of derogations that permit transfers even without an adequacy decision, SCCs, or BCRs, but only in limited, largely occasional circumstances: explicit informed consent from the data subject, necessity for performing a contract with the data subject, necessity for important reasons of public interest, or protection of vital interests. Regulators, including the European Data Protection Board, have been explicit that these derogations are meant for occasional, non-repetitive transfers, not as a substitute for establishing a proper structural mechanism for regular data flows. A company that routes its primary, ongoing EU-to-US data pipeline through “consent” as its legal basis for transfer is taking on meaningful regulatory risk, since consent must be specific, informed, and freely given for that exact transfer, and is easily challenged as invalid if the transfer is actually a routine business necessity dressed up as optional.
Common mistake
Treating the EU-US Data Privacy Framework as a permanent, “solved” compliance state is the single most common and costly mistake in this area. Given that Safe Harbor and Privacy Shield were both eventually invalidated by the CJEU, and that noyb has already filed fresh challenges to the DPF, an organization with no fallback SCCs or BCRs in place risks an abrupt transfer interruption if the framework is struck down again. Best practice as of 2026 is to treat the DPF as the primary, lower-friction mechanism while keeping SCCs executed and ready as an immediate fallback.
What worked
Companies that weathered the Schrems II transition most smoothly were the ones that had already executed Standard Contractual Clauses as a parallel mechanism before Privacy Shield was struck down, rather than relying on a single legal basis. They also invested early in genuine technical supplementary measures — strong encryption with keys held exclusively in the EU, and pseudonymization with the re-identification key never leaving EU jurisdiction — which held up regardless of which transfer mechanism was in force at any given moment.
Building a Resilient Cross-Border Transfer Program
Given the pattern of repeated invalidation, a defensible transfer program in 2026 typically layers mechanisms rather than betting on one. Practically, that means: maintaining executed SCCs with a completed Transfer Impact Assessment for every material data flow, regardless of whether the recipient is also DPF-certified; pursuing Binding Corporate Rules for large-scale, recurring intra-group transfers where the upfront approval time is justified by transfer volume; reserving Article 49 derogations strictly for genuinely occasional transfers; and implementing real technical supplementary measures — encryption, pseudonymization, and access controls — that reduce actual government access risk independent of which legal mechanism is nominally in place.
Ongoing monitoring is just as important as initial setup. Legal and privacy teams should track noyb’s litigation against the DPF, EDPB guidance updates (including the 2026 Processor BCR recommendations), and any changes to US surveillance law that could affect the “essentially equivalent” analysis underlying both the DPF and SCC-based transfers. A transfer mechanism that was defensible last year can become indefensible within months if the underlying legal environment shifts, which is exactly what happened to both Safe Harbor and Privacy Shield.
- Transfer Impact AssessmentA documented, per-transfer evaluation of a destination country’s laws and practices required to justify continued reliance on Standard Contractual Clauses after Schrems II.
- Supplementary measuresTechnical, contractual, or organizational safeguards — such as strong encryption with EU-held keys — applied on top of a transfer mechanism to close gaps identified in a Transfer Impact Assessment.
- Essential equivalenceThe CJEU’s standard requiring that a non-EU country’s data protection regime provide safeguards essentially equivalent to those guaranteed within the EU before transfers can rely on an adequacy-style mechanism.
- Consistency mechanismThe GDPR Article 63 process requiring coordination among EU supervisory authorities and a formal EDPB opinion before Binding Corporate Rules can be approved.
- Redress mechanismA legal pathway allowing EU data subjects to challenge government access to their transferred data, a requirement the CJEU found lacking in both Safe Harbor and Privacy Shield.
- Mechanism layeringThe practice of maintaining more than one valid transfer mechanism simultaneously (for example, DPF certification plus executed SCCs) so a legal challenge to one mechanism does not halt data flows.
How Transfer Mechanisms Connect to the Rest of a Privacy Program
Cross-border transfer decisions do not exist independently of the rest of a privacy program. Because transfer obligations differ so sharply depending on the destination jurisdiction, transfer strategy has to be built on top of an accurate regional map of requirements, covered in data sovereignty requirements by region. Many organizations are also increasingly evaluating sovereign cloud infrastructure — regional providers with local ownership and stronger resistance to foreign government access requests — as a way to reduce reliance on cross-border transfer mechanisms altogether, a topic explored in sovereign cloud infrastructure. Finally, once data does cross borders for analytics purposes, privacy-enhancing technologies like differential privacy and data clean rooms can reduce the sensitivity of what is actually transferred, a subject covered in privacy-enhancing technologies for analytics teams.
- Schrems II
- The 2020 CJEU ruling that invalidated the EU-US Privacy Shield framework and imposed a Transfer Impact Assessment obligation on organizations relying on Standard Contractual Clauses.
- EU-US Data Privacy Framework
- The adequacy decision adopted by the European Commission in July 2023 permitting transfers to certified US organizations, succeeding the invalidated Privacy Shield.
- Standard Contractual Clauses
- Pre-approved contractual terms published by the European Commission that data exporters and importers can adopt to provide GDPR-compliant safeguards for a cross-border transfer.
- Binding Corporate Rules
- Internal, regulator-approved data protection policies that permit intra-group cross-border data transfers within a single multinational corporate structure.
- noyb
- The European privacy advocacy organization founded by Max Schrems, responsible for the legal challenges that led to the invalidation of both Safe Harbor and Privacy Shield.
Key Takeaways
- Both of the EU-US Data Privacy Framework’s predecessors, Safe Harbor and Privacy Shield, were struck down by the CJEU, and the DPF itself now faces fresh legal challenges from noyb.
- Standard Contractual Clauses remain valid after Schrems II but must be paired with a documented Transfer Impact Assessment and, where needed, supplementary measures.
- Binding Corporate Rules suit large multinational groups with recurring intra-group transfers but typically take 12-18 months or longer to gain regulatory approval.
- Article 49 derogations, such as explicit consent, are intended only for occasional, non-repetitive transfers, not as a substitute for a structural transfer mechanism.
- A CJEU ruling on the DPF’s fresh legal challenges is plausible in the 2026-2027 timeframe, so relying on the DPF as a sole mechanism carries real continuity risk.
- Technical supplementary measures like strong encryption and pseudonymization with EU-held keys strengthen a transfer’s legal defensibility regardless of which primary mechanism is used.
- The most resilient organizations layer multiple mechanisms simultaneously so a legal challenge to any single one does not interrupt ongoing data flows.
FAQs
What replaced the EU-US Privacy Shield after Schrems II?
The EU-US Data Privacy Framework, adopted by the European Commission in July 2023, replaced Privacy Shield. It is an adequacy decision covering transfers to certified US organizations, addressing the surveillance and redress concerns the CJEU identified in Schrems II.
Are Standard Contractual Clauses still valid after Schrems II?
Yes. The CJEU confirmed SCCs remain a valid transfer mechanism, but data exporters must now conduct a Transfer Impact Assessment for each transfer and apply supplementary measures, or suspend the transfer, if the destination country’s laws undermine the contractual protections.
Is the EU-US Data Privacy Framework at risk of being struck down again?
It faces active legal challenges from noyb, the organization founded by Max Schrems, whose earlier complaints led to the invalidation of both Safe Harbor and Privacy Shield. A CJEU ruling is considered plausible in the 2026-2027 timeframe, though the DPF remains valid as of mid-2026.
How long does it take to get Binding Corporate Rules approved?
BCR approval typically takes 12-18 months or longer for a first-time application, since it requires coordination among multiple EU supervisory authorities and a formal opinion from the European Data Protection Board under the Article 63 consistency mechanism.
What is a Transfer Impact Assessment?
A Transfer Impact Assessment is a documented evaluation, required after Schrems II, of whether a destination country’s laws and government access practices undermine the protections in Standard Contractual Clauses, and whether supplementary measures can close any identified gap.
Can a company rely on consent alone to transfer data outside the EU?
Consent is one of the Article 49 derogations, but regulators intend it for occasional, non-repetitive transfers only. Using consent as the ongoing legal basis for a routine, recurring data pipeline is considered high-risk and easily challenged as invalid.
What are supplementary measures in the context of cross-border transfers?
Supplementary measures are technical, contractual, or organizational safeguards, such as strong encryption with keys held exclusively in the EU or robust pseudonymization, applied on top of a transfer mechanism to reduce the practical risk of foreign government access.
Why do companies use more than one transfer mechanism at the same time?
Layering mechanisms, such as maintaining Data Privacy Framework certification alongside executed Standard Contractual Clauses, protects against continuity disruption if any single mechanism is struck down by a future court ruling, as has happened twice already with Safe Harbor and Privacy Shield.
References
- Security Boulevard, “Schrems II and the Future of Cross-Border Data Transfers,” 2026.
- Congress.gov / Congressional Research Service, “EU Data Transfer Requirements and U.S. Intelligence Laws: Understanding Schrems II and Its Impact on the EU-U.S. Privacy Shield.”
- GlobalDataShield, “EU-US Data Privacy Framework in 2026: What Organizations Need to Know.”
- Secrails, “Cross Border Data Transfer: GDPR Rules, Transfer Impact Assessments, and What Actually Works in 2026.”
- European Data Protection Board, “Recommendations 1/2026 on the Application for Approval and on the Elements and Principles to be Found in Processor Binding Corporate Rules (Art. 47 GDPR).”
- European Commission, “Binding Corporate Rules (BCR),” Directorate-General for Justice and Consumers.
