Schrems II

CJEU C-311/18 — Privacy Shield declared invalid, SCCs + TIA as the typical safeguard

26 April 2026 · Category: GDPR · Compliance-Kit

TL;DR

Schrems II (CJEU C-311/18 of 16 July 2020) declared the EU-US Privacy Shield invalid. As a consequence, data transfers to Third Countries (outside the EU/EEA) for which no adequacy decision exists may take place only with additional safeguards — typically standard contractual clauses (SCCs 2021/914) plus a transfer impact assessment (TIA). The Data Privacy Framework (DPF, in force since July 2023) provides a new equivalent to the Privacy Shield for US transfers.

What is Schrems II?

Four main pillars following Schrems II:

SCCs 2021/914 as the standard safeguard for transfers to a Third Country
Transfer impact assessment (TIA): assessment of the level of protection in the Third Country and, where necessary, additional measures
Data Privacy Framework (DPF): adequacy decision for certified US companies (in force since July 2023, confirmed by the General Court (EuG), T-553/23, September 2025)
Binding Corporate Rules (BCR) for intra-group transfers

Practical example

Practical case: Microsoft 365 with the US subsidiary MS Inc. as a sub-processor.

Data processing agreement with Microsoft (the EU contracting party)
SCC annex for the transfer to the USA
TIA: take into account the access powers of US authorities (including FISA Section 702)
Alternative: DPF, provided the US recipient is included in the Data Privacy Framework List (check before use)
In practice: dual track (DPF + SCCs) as risk mitigation

Frequently asked questions

Do I need SCCs, or is the DPF sufficient?

If the US company is DPF-certified (included in the Data Privacy Framework List): the DPF is sufficient (no SCCs needed). If it is not certified: additional safeguards are required — typically SCCs plus a TIA, and for intra-group transfers also BCR. Best practice: a dual track, because of the uncertainty around the stability of the DPF.

How do I carry out a TIA?

5 steps: (1) identify the Third Country, (2) examine the level of protection (authorities' access rights, legal remedies), (3) additional measures (encryption, Pseudonymisation), (4) documentation, (5) regular review.

What should I do if the DPF is struck down?

An appeal against the General Court's judgment on the DPF (T-553/23) is pending before the Court of Justice (C-703/25 P); no decision had been issued as at 17 August 2026. Strategy: keep SCCs ready as a backup safeguard, use encryption at rest with EU-held keys, and prefer hosting in the EU where possible.