EU–US data transfers, vendor by vendor

Which entity you contract with, whether it is on the EU-U.S. Data Privacy Framework List, and how many of its subprocessors name a location outside the EEA — each read from the vendor's own pages or the official list.

What this page records, and what it does not

Since 10 July 2023 the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework lets personal data flow to US organisations that have self-certified to it and appear, active, on the Department of Commerce's Data Privacy Framework List. The column above is read from that list, entry by entry, and links to each participant's official page — including the entity that certified, which is not always the entity you contract with.

An entry is not a verdict that a transfer is lawful, and its absence is not a verdict that it is not: a vendor can rely on standard contractual clauses instead, or process EU data only in the EU. The SCC and notice columns are read from each vendor's data processing agreement, quoted on the vendor's page under "Processing terms"; only mechanisms the agreement itself relies on are counted, not ones it lists as possible safeguards. The contracting entity comes from the vendor's own terms; who owns it, from the Global LEI Index — see US CLOUD Act reach for that side.

"Outside the EEA" counts third-party subprocessors whose stated location includes a country outside the European Economic Area. It is arithmetic over the vendor's own list, not an assessment of any transfer. The vendor's own group companies are not counted.

What the agreements themselves commit to, counted across vendors - mechanisms, notice periods, breach deadlines: what the data processing agreements actually say.