Cross-border data transfers for ecommerce: GDPR, SCCs and adequacy decisions

Every ecommerce store with EU customers transfers personal data internationally. When a customer in Germany visits your US-hosted store and Google Analytics fires, EU personal data flows to Google's US infrastructure. When your EU-based store uses Klaviyo for email marketing, customer data moves to US servers. When you use Stripe for payments, cardholder data traverses international infrastructure.

GDPR restricts international transfers of personal data. Chapter V of the regulation requires that transfers to countries outside the European Economic Area are only made where an adequate level of protection is ensured. Stores selling across borders face a broader set of obligations covered in our international ecommerce compliance matrix. Most ecommerce operators either do not know this applies to their SaaS stack or assume their vendors handle it. Both assumptions are risky.

Why cross-border transfers matter for ecommerce

The legal concept of a "transfer" is broader than it might appear. Whenever an EU resident's personal data is accessible to or stored by an entity outside the EEA, a transfer has occurred. This covers:

• A US company processing EU customer orders through US servers
• An EU company using a US-based SaaS tool (email, analytics, CRM, helpdesk)
• A CDN that caches content including any personalization data on servers worldwide
• A payment processor routing transactions through data centers in non-EEA countries
• A cloud hosting provider whose infrastructure spans multiple continents

The restriction applies to the controller (you, the store) not just to the processor. If your processor transfers data outside the EEA, you are responsible for ensuring that transfer is lawful. Saying "Klaviyo handles it" is not a GDPR defense if you have not verified that Klaviyo's transfer mechanism is valid and documented it. You need to understand how third-party data sharing works across your entire vendor stack.

GDPR Chapter V: the three main transfer mechanisms

GDPR Article 45 through 49 set out the mechanisms for lawful international data transfers. Three are relevant to most ecommerce stores.

Adequacy decisions

The European Commission can decide that a third country provides an adequate level of data protection. Transfers to adequate countries can proceed without additional safeguards.

Countries with current EU adequacy decisions include: Andorra, Argentina, Canada (commercial organizations), Faroe Islands, Guernsey, Israel, Isle of Man, Japan, Jersey, New Zealand, South Korea, Switzerland, Uruguay and the United Kingdom.

The United States received a new adequacy decision in July 2023 under the EU-US Data Privacy Framework. This replaced the Privacy Shield framework invalidated by the Schrems II ruling in 2020. However, the EU-US DPF is already subject to legal challenge, and privacy advocates have indicated they intend to bring a Schrems III case. US companies that rely on the DPF should maintain fallback SCCs in their vendor agreements in case the framework is invalidated again.

Standard Contractual Clauses

Standard Contractual Clauses are the most widely used transfer mechanism for ecommerce stores. The European Commission publishes approved SCC templates. Including these clauses in contracts between a EU data exporter and a non-EU data importer creates a lawful transfer mechanism.

The Commission issued updated SCCs in June 2021 (replacing the pre-GDPR 2010 clauses). All new contracts must use the 2021 SCCs. Contracts using the old clauses that were signed before September 2021 should have been updated by December 2022.

The 2021 SCCs are modular. Four modules cover different transfer scenarios: controller to processor, controller to controller, processor to processor and processor to controller. Ecommerce stores most commonly need the controller-to-processor module (e.g., your store sends customer data to your email marketing platform).

Most major SaaS vendors serving EU customers have incorporated the 2021 SCCs into their data processing agreements. Shopify, Klaviyo, Stripe, Mailchimp and similar platforms offer DPAs with SCCs in their contract terms. But you need to sign them, not just assume they are in force.

Binding Corporate Rules

Binding Corporate Rules are internal data protection policies approved by a lead supervisory authority. They allow intra-group transfers within multinational companies. For most ecommerce stores, BCRs are not relevant: they are expensive to establish and only useful for transfers within a single corporate group.

Transfer Impact Assessments

Following the Schrems II decision, the European Data Protection Board issued guidance requiring that controllers conduct a Transfer Impact Assessment (TIA) before relying on SCCs for transfers to countries that may have surveillance laws allowing government access to transferred data. The United States is the primary country of concern given the NSA surveillance programs disclosed by Edward Snowden.

A TIA assesses whether the legal framework of the destination country allows for interference with the level of protection provided by the SCCs. If a TIA concludes that the SCCs do not provide sufficient protection in practice, the transfer cannot proceed without additional measures.

For transfers to US processors, a TIA typically needs to address: whether the processor is subject to FISA 702 surveillance orders, what the actual risk is that relevant data would be subject to government access and what supplementary measures (encryption, pseudonymization, data minimization) reduce that risk.

Many EU supervisory authorities have taken a pragmatic view: TIAs for standard commercial SaaS relationships, where the data is not likely to be of interest to intelligence services, can reach positive conclusions. A TIA for customer email lists, purchase history or browsing behavior is different from a TIA for data that might attract government surveillance.

Where ecommerce data actually flows

Most ecommerce stores transfer EU customer data to the following categories of third countries without realizing it:

• Analytics platforms. Google Analytics 4 (US infrastructure). Meta analytics via Pixel (US). Microsoft Clarity (US). Each fires when an EU user visits your site and sends behavioral data internationally.
• Email marketing. Klaviyo (US), Mailchimp (US), Omnisend (US). Every EU customer record in your email tool is an international transfer.
• Payment processors. Stripe (US/Ireland), PayPal (US), Adyen (Netherlands but with global data centers). Payment data flows through international infrastructure.
• CDNs. Cloudflare, Fastly, Akamai. CDNs cache content globally. Some personalization data can end up on CDN nodes outside the EEA.
• Cloud hosting. AWS, GCP, Azure all have EEA data centers but data may be accessible by support staff globally, which can constitute a transfer depending on access controls.
• Customer service tools. Zendesk (US), Gorgias (US), Freshdesk (India/US). Ticket data including customer details flows internationally.
• Advertising platforms. Google Ads, Meta Ads, TikTok Ads. Customer matching and audience creation transfers data to US and other international infrastructure.

The EU-US Data Privacy Framework: current status

The EU-US Data Privacy Framework entered into force on July 10, 2023. It allows US companies that self-certify with the DPF to receive EU personal data without additional transfer safeguards.

To rely on a US vendor's DPF certification, you need to verify that the vendor is actually certified. Certification is listed at dataprivacyframework.gov. Certification is not automatic: US companies must actively self-certify, pay fees and renew annually.

Major ecommerce SaaS providers are certified. Google, Meta, Stripe, Mailchimp, Klaviyo and most large US cloud providers hold DPF certifications. But smaller vendors may not. Always verify before relying on DPF as the transfer mechanism.

Given the legal uncertainty around the DPF, prudent practice is to use both DPF and SCCs as overlapping transfer mechanisms where possible. If your vendor is DPF-certified and you have signed SCCs with them, you have a fallback if the DPF is invalidated.

UK adequacy post-Brexit

The UK left the EU at the end of 2020. The European Commission granted the UK an adequacy decision in June 2021 under the UK GDPR framework. This allows transfers from the EEA to the UK without additional safeguards.

The UK adequacy decision was subject to a four-year review. The Commission reassessed and renewed it in 2025. However, the UK government has been amending UK GDPR through the Data Protection and Digital Information Act. The EU Commission has indicated it will monitor whether UK data protection standards remain adequate as these amendments take effect.

For transfers in the other direction, from the UK to third countries, UK GDPR has its own transfer restriction framework. Post-Brexit the UK has issued its own adequacy regulations and its own International Data Transfer Agreements (IDTAs) as the UK equivalent of SCCs. EU SCCs signed after Brexit do not automatically serve as valid UK transfer mechanisms. UK stores dealing with transfers from UK data subjects to non-adequate third countries need UK IDTAs.

Practical compliance steps for ecommerce stores

• Map your data flows. Create an inventory of every vendor that receives EU personal data and where that vendor processes it. Include your analytics platforms, email tools, payment processors, helpdesk software and ad tech.
• Identify the transfer mechanism for each. For each vendor, determine which transfer mechanism you are relying on: adequacy decision (list which one), SCCs (check which version), or DPF certification (verify at dataprivacyframework.gov).
• Sign DPAs with SCCs. For US vendors, sign their data processing agreement if you have not already. Most large SaaS providers offer DPAs through their settings panel or on request. These typically include SCCs.
• Conduct TIAs for high-risk transfers. For transfers of significant personal data volumes to US vendors not covered by the DPF, document a TIA. The European Data Protection Board provides templates.
• Update your privacy policy. GDPR requires disclosure of international transfers in your privacy policy. Describe what categories of data are transferred, to which countries and under what safeguards.
• Review CDN and hosting configurations. Ensure your hosting and CDN infrastructure has EU data residency options enabled where possible. For US cloud providers, configure data processing to occur in EU regions. Taking a privacy by design approach to your infrastructure reduces transfer complexity from the start.
• Handle UK transfers separately. If you are an EU-based store with UK customers or vice versa, document the UK-EU adequacy relationship and ensure UK GDPR requirements are met for UK data subjects.

Consequences of unlawful transfers

Unlawful international data transfers are a GDPR violation subject to fines of up to 4% of global annual turnover or 20 million euros, whichever is higher. Supervisory authorities have used this enforcement power.

The most significant transfer enforcement action to date was Meta's 1.2 billion euro fine from the Irish Data Protection Commission in May 2023. The fine was specifically for unlawful transfers of Facebook user data from the EU to the US without adequate safeguards. It remains the largest GDPR fine ever issued.

For mid-market ecommerce stores, supervisory authority investigations are typically triggered by consumer complaints. A customer submits a data subject access request, discovers their data is processed in the US, files a complaint, and the SA begins an inquiry. The combination of unlawful transfers and inadequate documentation is what typically escalates inquiries into formal enforcement actions.

Frequently asked questions

What are Standard Contractual Clauses (SCCs)?

SCCs are European Commission-approved contract templates that create a lawful mechanism for transferring EU personal data to countries outside the EEA. The 2021 modular SCCs replaced the older 2010 versions and must be included in data processing agreements with non-EU vendors.

Is the EU-US Data Privacy Framework still valid?

Yes, as of late 2026 the EU-US DPF entered into force in July 2023 and remains valid. However, it faces legal challenge and privacy advocates have signaled a Schrems III case. Prudent practice is to maintain SCCs as a fallback alongside DPF certification.

Does using Klaviyo or Mailchimp create a cross-border data transfer?

Yes. Both are US-based platforms. Every EU customer record stored in these tools constitutes an international data transfer under GDPR. You need either DPF certification from the vendor or signed SCCs in your data processing agreement to make the transfer lawful.

What is a Transfer Impact Assessment?

A TIA is an assessment required after the Schrems II decision that evaluates whether the legal framework of the destination country allows government interference with the protection provided by SCCs. It is required before relying on SCCs for transfers to countries with surveillance laws.