Privacy Shield fell. Schrems II (2020) reminds us: transferring to the US (and other countries without adequacy) requires more than standard contractual clauses. Your host displays "SCCs included". The auditor asks for the Transfer Impact Assessment (TIA): silence.
Beyond the selected region, hosting must prove Art. 46 mechanisms hold against importer country local law.
Schrems II: what changes in practice
Privacy Shield adequacy decision was invalidated. SCCs remain valid if effective in practice. The controller must assess (TIA) authority access risk (FISA, Cloud Act). Supplementary measures apply if SCCs alone are insufficient.
Proof to require from the host
| Proof | Content |
|---|---|
| Signed SCCs | Adapted module (C2C or C2P) + annexes |
| ST list | Full chain + countries |
| Transparency | Government request reports |
| Technical | Encryption, segmentation, client keys |
| TIA cooperation | Info on possible access, entity jurisdiction |
Common supplementary measures
Strong encryption at rest and in transit, client-held keys (BYOK), pseudonymization, EU hosting by non-US entity, avoid unnecessary identifying metadata on US services. No magic list — TIA documents case adequacy.
Cross-check Transfers outside EU and GDPR, HDS, SecNumCloud for your sector.
The peak: region is hypothesis, TIA is proof
Decide and move forward without blind spots
Identify all non-EU flows in your architecture, including CDN, backup, and support. Draft a TIA per at-risk destination. Implement supplementary measures or replace US service if TIA requires. Review analysis annually or on architecture change. See our guides and directory to compare documentary transparency.
Frequently asked questions
Does Schrems II concern a 100% French host?
Yes as soon as one link involves transfer to a country without adequacy decision.
Are SCCs enough after Schrems II?
No — TIA and supplementary measures if needed.
What to ask the host?
SCCs, subprocessors, government transparency, TIA assistance.
Can you host in the United States?
Possible with rigorous TIA — not SCCs alone.
Schrems II: selected region opens the file — TIA closes it, or not.