Schrems II (Third-Country Transfers)
"Schrems II" is a 2020 ruling by the Court of Justice of the European Union (case C-311/18) that declared the EU-US data protection agreement "Privacy Shield" invalid and set stricter requirements for transferring personal data to the United States and other third countries.
In practice
In practice, the ruling mainly affects companies that use US services such as cloud storage, analytics tools or email marketing software. Before using a service it is worth checking whether the provider takes part in the current EU-US Data Privacy Framework, which has served as the successor to Privacy Shield since 2023 and was upheld by the General Court of the European Union on 3 September 2025 (T-553/23), though an appeal against that judgment is pending before the Court of Justice – its long-term survival should not be treated as settled, given current political and legal developments in the United States. If it does not take part, or in case of doubt, you need standard contractual clauses plus additional technical measures such as encryption.