We're based in United States. We understand that any sub-processor that we use should be EU-US Privacy Shield certified and GDPR compliant. So, we can use AWS and Google Cloud. Both of them are EU-US Privacy Shield certified.

But does my own company also needs to be EU-US Privacy Shield certified also?

Can we declare ourselves GDPR compliant after doing the due diligence but not have to certify ourselves in the EU-US Privacy Shield?

  • Are you caught by the GDPR's extraterritorial provisions? Not all foreign controllers/processors of the personal data of people in the EU are. Do you know whether you are a controller and/or a processor? This may be relevant. – Sam_Butler Feb 28 '20 at 13:54
  • By the way, you can "declare yourself" anything you want to, but this has no basis in law. A company caught by the GDPR must be capable of demonstrating compliance, and certification methods are not yet implemented. This is different from Privacy Shield, which is a self-certification framework. – Sam_Butler Feb 28 '20 at 13:55
  • 1
    @Sam_Butler We don't have our own servers. We have some employees in EU and we believe we're a processor (A SAAS providing services to EU companies). We use Google Firebase and AWS RDS to get, process and store customer data. We're a US company and use US servers in Google Cloud and Amazon Web Services. So I believe GDPR's extraterritorial provisions apply to us. – harsh989 Mar 2 '20 at 7:22

Based on the information provided in the question and comments, you are a Software as a Service provider established outside the European Union, providing services to European Union clients who will use your SaaS solution to process personal data that is subject to the jurisdiction of the GDPR. If you market your service to consumers in the Union, you are also caught by the GDPR's extraterritorial provisions.

As such, those controllers established in the Union must comply with the requirements of Article 28 in respect of processors they engage, including yourselves. When they transfer personal data to you, it is transferred to a third country and subject to Chapter V of the GDPR. The EU-U.S. Privacy Shield Framework is subject to an adequacy decision recognised pursuant to Art. 45(9) GDPR.

The above would suggest that as the contracting party to whom the controller transfers personal data, irrespective of your use of sub-processors, you must self-certify under Privacy Shield. You will also need to provide an executable (signable) data protection addendum to your terms for EU (and EEA, UK, etc.) clients, and you should be prepared to disclose the identity of your sub-processors. Bear in mind Art. 28(4) that imposes the same terms on sub-processors as in the top-level processor contract.

  • What should non EU non US companies do? – ask Dec 1 '20 at 16:05
  • That’s not really a comment on this answer, if you have a specific question you should write it as a new question and give all the details. Even my answer above is no longer valid as the EU-US Privacy Shield was subsequently invalidated. – Sam_Butler Dec 3 '20 at 7:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.