# What is Schrems II and does it still matter in 2026?

Last updated: 2026-11-10

Schrems II is the name for a judgment of the Court of Justice of the EU, delivered on 16 July 2020 in Case C-311/18. It struck down Privacy Shield, the deal that let European companies send personal data to the US, and said that standard contractual clauses stay valid only if the sender checks that the data is really protected in the country it goes to. It still matters: the 2023 EU-US Data Privacy Framework rests on the test the court set, and any transfer outside an adequacy decision that leans on contractual clauses still needs the checks Schrems II requires.

This page explains the law in plain words. It isn't legal advice.

## Schrems II at a glance

| Question | Short answer |
|---|---|
| Which court? | Court of Justice of the European Union, Luxembourg |
| When? | 16 July 2020 |
| Who brought it? | Max Schrems, an Austrian Facebook user, through a complaint to the Irish supervisory authority |
| What fell? | Privacy Shield, Commission Decision 2016/1250 |
| What survived? | Standard contractual clauses, Decision 2010/87, with a duty to verify protection before each transfer |
| Why? | US surveillance law wasn't limited to what is strictly necessary, and Europeans had no real remedy before a court |
| What replaced Privacy Shield? | The EU-US Data Privacy Framework, in force since 10 July 2023 |
| Is that framework safe from challenge? | A challenge failed before the General Court on 3 September 2025, and that judgment was open to appeal on points of law only |

## What the court decided

The GDPR lets personal data leave the EU in three main ways: to a country the European Commission has found adequate, under appropriate safeguards such as standard contractual clauses, or under narrow exceptions. Schrems II tested the first two for the US.

On Privacy Shield, the court found three problems:

- **Surveillance went too far.** Certain US surveillance programmes weren't limited to what is strictly necessary, so they failed the EU test of proportionality.
- **No rights in court.** People whose data was transferred had no actionable rights before the courts against US authorities.
- **The ombudsperson offered no real remedy.** The complaint channel set up by Privacy Shield came with no guarantees of independence and no power to bind US intelligence services.

On standard contractual clauses, the court said the clauses are valid even though they're only a contract that can't bind a foreign government. The catch is the duty that comes with them: the exporter and the recipient must check, before the transfer, whether the destination's laws let the clauses work. If the recipient can't comply, the exporter has to suspend the transfer or end the contract. Where no valid adequacy decision applies and the exporter hasn't stopped on its own, data protection authorities must suspend or prohibit transfers when the clauses can't be complied with and protection can't be ensured another way.

The judgment's core standard is "essentially equivalent": data leaving the EU must keep a level of protection essentially equivalent to what the GDPR, read with the EU Charter of Fundamental Rights, gives inside the EU.

## What has happened since 2020

| Date | Event |
|---|---|
| 6 October 2015 | Schrems I: the Court of Justice declares the earlier Safe Harbour decision invalid |
| 16 July 2020 | Schrems II: Privacy Shield invalidated, contractual clauses kept with conditions |
| 4 June 2021 | The Commission issues modernised standard contractual clauses under the GDPR |
| 18 June 2021 | The European Data Protection Board adopts the final version of its recommendations on supplementary measures |
| 7 October 2022 | US Executive Order 14086 adds safeguards for intelligence activities; a later Attorney General regulation sets the rules for the Data Protection Review Court |
| 10 July 2023 | The Commission adopts Implementing Decision 2023/1795, finding the US adequate under the new framework |
| 3 September 2025 | The General Court dismisses Philippe Latombe's action to annul that decision |

In the Latombe case, the General Court found enough safeguards around the review court's judges to call it independent. On bulk collection, it read Schrems II as requiring no prior approval by an independent authority, with review by a court after the fact as the minimum. It also pointed out that the Commission has to watch US law continuously and can pull back or limit the decision if that law changes.

## Why it still matters for your app

- **The framework covers only US companies that take part in it.** Data sent to a US recipient outside the framework needs another tool, usually standard contractual clauses, and those bring back the Schrems II check.
- **The framework depends on US rules that can change.** It rests on an Executive Order and the review court built around it. If they change, the Commission can suspend or repeal its decision, and you'd be back to contractual clauses and transfer assessments.
- **A court win covers one moment.** The General Court judged US law as it stood on the day the decision was adopted. A later change, or a new case, can bring the framework back before the judges, and a third ruling against a US arrangement would hit every company relying on it at once.
- **Your subprocessors count.** Email, analytics, error tracking, Git hosting and support tools often sit with US companies. Each one is a transfer you have to account for, even when your servers are in Europe.

## What to check in your hosting stack

- **Where personal data actually goes.** Map every service that receives it: hosting, backups, logs, email, monitoring and sign-in.
- **The legal basis for each transfer.** For each non-EU recipient, note whether it relies on an adequacy decision, the Data Privacy Framework or standard contractual clauses.
- **Framework status.** For US recipients that say they rely on the Data Privacy Framework, confirm it in their privacy notice or data processing terms, and check that it covers the kind of data you send. The [Data Privacy Framework explainer](/i/eu-us-data-privacy-framework) goes into more detail.
- **A written transfer assessment.** Where you rely on contractual clauses, document why the destination's law lets them work, and which extra measures you use. See [standard contractual clauses](/i/standard-contractual-clauses) for how the clauses themselves work.
- **A plan B.** Know which services you'd replace or reconfigure if the framework fell.

The European Data Protection Board turned the judgment into six steps for exporters:

1. Know your transfers, and send only the data you need.
2. Identify the transfer tool each transfer relies on.
3. Assess whether the destination's law or practice undermines that tool.
4. Adopt supplementary measures where it does, or stop the transfer.
5. Take any formal steps those measures require.
6. Re-evaluate at regular intervals.

## Where hosting fits in

A provider's company and its suppliers decide how many transfers you inherit. Keeping personal data with European companies on European infrastructure reduces the number of transfers you have to justify, but it doesn't remove the need to check suppliers. For the related US law, see [EU region vs EU company](/i/eu-region-vs-eu-company-cloud-act), and for the vocabulary, [data residency vs data sovereignty](/i/data-residency-vs-data-sovereignty).

Take Eurobase as a worked case. The business behind it is registered in Warsaw, Poland, and your apps run on European infrastructure run by Scaleway, a French provider. On its subprocessor page, GitHub, Inc. and GitLab Inc. are the two US entries, and each becomes active only if you connect that service, with the provider's contractual transfer safeguards. If you'd rather keep your code with a European host, Codeberg e.V. in Germany is also on the list. Neither an ISO 27001 certificate nor a SOC 2 report is in hand yet; both are in progress. For a broader list of what to verify with any host, use the [GDPR hosting checklist](/i/gdpr-hosting-checklist).

## Frequently asked questions

### Is Privacy Shield still valid?

No. The Court of Justice declared it invalid on 16 July 2020. Its replacement is the EU-US Data Privacy Framework, with an adequacy decision dated 10 July 2023 that lets data flow to US companies taking part in it.

### Did the Data Privacy Framework fix Schrems II?

It answers the two points the court raised, with limits on surveillance under a 2022 Executive Order and a new review court for complaints. The General Court accepted that in September 2025, judging US law as it stood in July 2023, so the framework still depends on those US rules staying in place.

### Do I need a transfer impact assessment if I use a US provider?

If the provider takes part in the Data Privacy Framework and your transfer falls under it, the adequacy decision covers the transfer itself. If you rely on standard contractual clauses instead, Schrems II expects you to assess the destination's law and document it.

### Does hosting in an EU region of a US cloud avoid Schrems II?

Not entirely. Storing data in Frankfurt or Dublin helps, but remote access, support and US parent companies can still mean data is made available outside the EU. Check the company and its subprocessors, not only the region.

### What is the difference between Schrems I and Schrems II?

Schrems I, in October 2015, struck down Safe Harbour. Schrems II, in July 2020, struck down its successor, Privacy Shield, and set conditions on standard contractual clauses.

## Sources

- [Court of Justice press release 91/20: Schrems II, Case C-311/18](https://curia.europa.eu/jcms/upload/docs/application/pdf/2020-07/cp200091en.pdf)
- [General Court press release 106/25: Latombe v Commission, Case T-553/23](https://curia.europa.eu/jcms/upload/docs/application/pdf/2025-09/cp250106en.pdf)
- [European Commission: EU-US data transfers](https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/eu-us-data-transfers_en)
- [European Commission: standard contractual clauses](https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en)
- [EDPB Recommendations 01/2020 on supplementary measures](https://www.edpb.europa.eu/our-work-tools/our-documents/recommendations/recommendations-012020-measures-supplement-transfer_en)
- [Eurobase subprocessors](/legal/subprocessors) and [Eurobase data processing agreement](/legal/dpa)