Originally published on moveinfra.eu .

European companies can currently use US cloud providers legally under the GDPR, provided the provider is certified under the EU-US Data Privacy Framework (DPF) or the customer has valid Standard Contractual Clauses (SCCs) and a Transfer Impact Assessment in place. In July 2023, the European Commission adopted the DPF adequacy decision, and in September 2025, the EU General Court upheld the framework in the Latombe v. Commission ruling. However, legal uncertainty remains. The General Court ruling is under appeal before the European Court of Justice (Case C-703/25 P), the DPF relies on US executive orders that a US president can modify or revoke, and US laws like the CLOUD Act still apply to US-headquartered companies regardless of where data is stored.…