EU Hosting vs US Cloud: Can the US Reach Your Data?

EU hosting vs US cloud is mostly a question of which country’s law your provider answers to. Using a US cloud provider can be lawful today: the EU-US Data Privacy Framework (DPF) has been in force since July 2023 and was still in force on 23 October 2026. But a US provider stays subject to US law even when your data sits in Frankfurt or Dublin, and the DPF is the third EU-US transfer deal after two were struck down. Hosting with an EU provider that has no US parent takes the transfer question out of your hosting.

Below are the two court rulings, the US law and the framework behind that answer, with the status of each in October 2026. We are engineers, not lawyers, so treat this as background for business decisions and ask a data protection lawyer for anything binding.

In short

GDPR doesn’t require EU hosting. It requires that the protection of personal data sent outside the EU/EEA is not undermined (GDPR Articles 44 to 46), which the CJEU reads as “essentially equivalent” protection.
The CJEU struck down Safe Harbor in 2015 and Privacy Shield in 2020 (Schrems II). The DPF replaced them in July 2023.
The DPF survived its first court challenge in September 2025. The appeal, case C-703/25 P, was still pending at the Court of Justice on 23 October 2026.
The US CLOUD Act lets US authorities require a provider under US jurisdiction to disclose data in its control “regardless of” where it is stored, so an EU region on a US cloud doesn’t remove US jurisdiction.
Hosting with an EU provider that has no US parent needs no transfer mechanism, so a future Schrems III ruling wouldn’t change your hosting setup.

EU hosting vs US cloud: what the law says

GDPR allows transfers of personal data outside the EU/EEA only under the conditions in Chapter V (Article 44). The two everyday routes are an adequacy decision by the European Commission (Article 45) or appropriate safeguards such as Standard Contractual Clauses (Article 46).

Safe Harbor (2000 to 2015) was the first EU-US framework. The Court of Justice of the EU (CJEU) declared it invalid on 6 October 2015 in Schrems I (C-362/14), after Max Schrems complained about Facebook’s transfers of his data to the US following the Snowden disclosures.

Its replacement, Privacy Shield (2016 to 2020), fell on 16 July 2020 in Schrems II (C-311/18). The court found that FISA Section 702 does not indicate any limitations on the surveillance programmes it allows, or any guarantees for non-US persons targeted by them (paragraph 180), that bulk collection under Executive Order 12333 was not limited in a sufficiently clear and precise way (paragraph 183), and that the Privacy Shield ombudsperson gave EU residents no remedy before a body meeting the standard of Article 47 of the EU Charter (paragraph 197).

What happened to the EU-US Privacy Shield?

It was declared invalid in Schrems II and was not repaired. The court did not maintain its effects, so there was no grace period: the EDPB said in its July 2020 FAQ that transfers on the basis of Privacy Shield were illegal. Companies that had relied on it needed another Chapter V route, such as Standard Contractual Clauses, while the EU and US negotiated a new framework.

On Standard Contractual Clauses (SCCs), Schrems II found nothing affecting the validity of the Commission’s SCC decision, with a condition: the exporter must check, case by case, whether the law of the destination country undermines the clauses and add safeguards where needed (paragraph 134). The European Data Protection Board turned that into a six-step method in its Recommendations 01/2020 (version 2.0, adopted 18 June 2021). If no supplementary measure makes the transfer safe, the exporter must avoid, suspend or end it.

The EU-US Data Privacy Framework came next. On 10 July 2023, the Commission adopted Implementing Decision (EU) 2023/1795, finding that the US ensures adequate protection for data sent to organisations on the Data Privacy Framework List. It rests on new US safeguards in Executive Order 14086 (October 2022), including a Data Protection Review Court for complaints from EU residents.

Is the EU-US Data Privacy Framework still valid?

Yes. On 23 October 2026, the United States (for organisations in the DPF) was still on the Commission’s list of adequacy decisions, and a transfer to a certified US company is lawful without SCCs. The framework is also under pressure in five ways:

Philippe Latombe asked the EU General Court to annul the decision. The court dismissed his action on 3 September 2025 in case T-553/23, noting that the legality of the decision must be assessed on the facts and law as they stood when it was adopted in 2023. Latombe appealed on 31 October 2025. The Court of Justice’s register listed the appeal, C-703/25 P, as pending on 23 October 2026, with no judgment.
On 29 June 2026, the US Supreme Court held in Trump v. Slaughter that the law protecting FTC commissioners from removal without cause is unconstitutional. The adequacy decision refers to the FTC’s independence, and on 31 July 2026 the EDPB asked the Commission to assess whether the ruling affects the framework. The privacy group noyb called for the decision to be withdrawn on 29 June 2026 and said it would file a lawsuit in the coming weeks. On 23 October 2026, noyb’s site showed no later update on that lawsuit.
Executive Order 14086 gives the Privacy and Civil Liberties Oversight Board (PCLOB) an oversight role, as the Commission’s first review report notes. On 23 October 2026, the PCLOB’s board page listed one member. By statute, the board needs three members for a quorum.
According to the Congressional Research Service (22 June 2026), Section 702 was automatically repealed on 12 June 2026, when its last short extension ran out. Orders the surveillance court reportedly approved in March 2026 stay in effect until they expire, up to a year after issue. The public laws published on govinfo.gov up to 15 October 2026 include no renewal, but Congress can still pass one, so check the current status before relying on this.
The Commission’s first periodic review, published on 9 October 2024, found that the US had put the necessary structures in place. The Commission said it would carry out the next review after three years. GDPR Article 45(3) requires a review at least every four years.

None of this has ended the DPF, because a decision stays in force until the Commission withdraws it or the Court of Justice annuls it. The risk for a business is that it relies on a framework whose future depends on court cases and US politics it can’t influence.

What is the US CLOUD Act?

The CLOUD Act is a 2018 US law. Its core section, 18 U.S.C. § 2713, requires providers of electronic communication and remote computing services to preserve or disclose data in their “possession, custody, or control”, regardless of whether the data is located within or outside the United States. According to the EDPB and EDPS (see below), Congress passed it while the Microsoft Ireland case was pending at the US Supreme Court, to make clear that US authorities can require a provider under US jurisdiction to produce data stored abroad.

So server location alone doesn’t protect you: data in a US provider’s EU data centre is still in the control of a company that can be served with a US order. Microsoft France’s director of public and legal affairs was asked under oath by a French Senate inquiry on 10 June 2025 whether he could guarantee that French citizens’ data entrusted to Microsoft through the public purchasing agency UGAP would never be handed over to the US government, following an order from it, without the explicit agreement of the French authorities. He answered that he could not, adding that it had never happened.

GDPR has a rule pointing the other way. Under Article 48, a foreign court order to hand over personal data is recognised or enforceable only if it is based on an international agreement such as a mutual legal assistance treaty. In their 2019 joint assessment, the EDPB and the European Data Protection Supervisor concluded that unless a CLOUD Act warrant is recognised or made enforceable through such an agreement, the lawfulness of handing over the data can’t be established, apart from narrow cases. A provider can therefore be caught between the two laws.

The same EDPB/EDPS assessment notes that the CLOUD Act doesn’t authorise systematic, large-scale or indiscriminate collection; it covers targeted requests in specific law enforcement investigations. For most small businesses the problem is legal and commercial: it complicates your transfer assessment, and it ties your compliance to laws and litigation you don’t control.

Does an EU region on a US cloud count as a transfer?

Not automatically. The EDPB’s Guidelines 05/2021 (version 2.0, February 2023) cover this exact case in Example 12: an EU company uses an EU processor whose parent company is in a third country. If the data is processed only in the EU and nobody outside the EU has access, handing it to the EU processor is not a transfer. If the processor later complies with a foreign authority’s request, that disclosure is a transfer.

The guidelines add that the controller should assess this risk before choosing the processor, as part of its duty under Article 28 to use only processors with sufficient guarantees. A processor’s reliability “may be in doubt”, they say, if it is subject to third-country law that may prevent it from meeting its obligations. So an EU region on a US cloud doesn’t need a transfer tool for storage alone, but you still have to assess the risk of foreign access.

The large US providers have responded with European structures. AWS, for example, opened its AWS European Sovereign Cloud in Germany in January 2026 and says it operates independently from its existing regions. Whether such set-ups put data out of reach of a US parent company is a legal question. If your business depends on the answer, get a lawyer’s opinion on the specific contract.

Can EU data be stored in the US?

Yes. Storing personal data with a US provider in the US is a transfer, and it’s lawful if one of the Chapter V routes applies:

The provider is certified under the DPF (check the DPF List), or
You sign SCCs and carry out a transfer impact assessment with supplementary measures following EDPB Recommendations 01/2020, or
A narrow derogation in Article 49 applies, such as explicit consent for a specific transfer. The EDPB’s Recommendations say derogations “cannot become ‘the rule’ in practice” and must be restricted to specific situations, so they don’t suit ongoing hosting.

If the DPF were annulled without a transition period, route 1 would disappear at once, as Privacy Shield did in 2020, and you would fall back on route 2.

EU hosting vs US cloud: a practical comparison

Question	EU provider, no US parent	US provider, EU region	US provider, US region
Transfer tool needed for hosting	No	Not for storage alone (EDPB Example 12), but assess the access risk	Yes (DPF or SCCs + assessment)
If the DPF is annulled	Unaffected	Storage unaffected, but any access from the US (support, the parent company) needs a new tool	Need SCCs + assessment at once
Subject to the CLOUD Act	Not through a parent company; check for US operations	Yes, through the US parent	Yes
What a customer’s data protection review will ask about	Sub-processors	Sub-processors, access from outside the EU, US jurisdiction	Sub-processors, the transfer tool, US jurisdiction
Network distance to EU visitors	Short	Short	Transatlantic
Cost	Depends on the workload, so compare like for like	Same	Same

European hosting providers include Hetzner (Gunzenhausen, Germany), OVHcloud, Scaleway (Paris) and IONOS (Montabaur, Germany), plus many national hosts. Some also have locations outside the EU (Hetzner’s cloud, for example, lists Ashburn, Hillsboro and Singapore), so check the location you choose. Then check that the managed services you depend on exist, and compare prices for the same workload.

What this means for different businesses

A local business website usually collects little personal data: a contact form and perhaps analytics. EU hosting shortens the transfer section of your privacy policy, and cookieless, GDPR-compliant analytics removes another set of third-party data flows.

A webshop handles names, addresses and order histories, and the transfer question applies to every processor in its stack, from payments to email and analytics. We cover the whole stack in our guide to building a GDPR-ready webshop and the day-to-day items in the GDPR checklist for online shops.

A SaaS company that processes personal data for business customers needs a processing contract and their authorisation before it engages sub-processors (Article 28 GDPR), so its hosting provider ends up in their review. If you’re starting out, our article on building a SaaS MVP in Europe covers hosting choices as part of the first build.

Is there a European alternative to AWS?

Yes, for standard website, webshop and SaaS building blocks. Scaleway, for example, lists virtual instances, managed Kubernetes (Kapsule), managed PostgreSQL and MySQL databases and S3-compatible object storage. If you depend on a more specialised managed service, check whether an EU provider has an equivalent before you plan a move.

You can build a defensible position on a US cloud today: rely on the DPF, sign SCCs as a fallback, document a transfer impact assessment and follow the litigation.

Our view is that this is a lot of ongoing legal work to defend a choice that, for most small and mid-sized European businesses, adds little. With an EU provider that has no US parent, there is no adequacy decision to follow for your hosting, no supplementary measures to document for it and nothing to change there if a Schrems III ruling lands.

Our Essential website plan (€190/mo excl. VAT) includes EU hosting, and our Launch build (€1,900 one-time excl. VAT) includes EU hosting setup. All our prices are published on our pricing page:

GDPR-compliant website development: marketing sites, with EU hosting in the Essential plan
GDPR-compliant webshop development: e-commerce builds
Web app development: custom web apps and SaaS
SEO services: technical SEO, content and reporting

If you’re unsure where your current site’s data goes, send us your hosting setup.

Frequently asked questions

Is it illegal to use AWS, Google Cloud or Azure in the EU? No. With the DPF in force and the right contracts, it can be lawful. The open question is how long that position holds, given the pending challenges to the DPF and the CLOUD Act’s reach.

Does an EU region on a US cloud make me GDPR-compliant? It means storage in the EU is not a transfer in itself, according to the EDPB. It doesn’t remove US jurisdiction over the provider, and the EDPB expects you to assess the risk of foreign access when you choose the processor.

What happened in Schrems II, in one sentence? On 16 July 2020, the CJEU invalidated the EU-US Privacy Shield because US surveillance law and the lack of an effective remedy fell short of EU standards, and kept SCCs valid only with case-by-case assessment.

Could the Data Privacy Framework be struck down? It’s possible. An appeal against it (C-703/25 P) is pending at the Court of Justice, noyb has announced a further challenge, and the EDPB has asked the Commission to assess the impact of Trump v. Slaughter. Nobody can predict the outcome. If your hosting doesn’t rely on the DPF, the outcome won’t change it.

Do I need a lawyer? For a small site on EU infrastructure, the hosting transfer questions in this article fall away, though the rest of GDPR still applies. If you transfer personal data to US providers at scale, sign enterprise data processing agreements or process sensitive data, get a data protection lawyer’s assessment. This article is engineering background and not legal advice.