Law Stack Exchange is a question and answer site for legal professionals, students, and others with experience or interest in law. It only takes a minute to sign up.
Sign up to join this community
We're based in United States. We understand that any sub-processor that we use should be EU-US Privacy Shield certified and GDPR compliant. So, we can use AWS and Google Cloud. Both of them are EU-US Privacy Shield certified.
But does my own company also needs to be EU-US Privacy Shield certified also?
Can we declare ourselves GDPR compliant after doing the due diligence but not have to certify ourselves in the EU-US Privacy Shield?
Based on the information provided in the question and comments, you are a Software as a Service provider established outside the European Union, providing services to European Union clients who will use your SaaS solution to process personal data that is subject to the jurisdiction of the GDPR. If you market your service to consumers in the Union, you are also caught by the GDPR's extraterritorial provisions.
As such, those controllers established in the Union must comply with the requirements of Article 28 in respect of processors they engage, including yourselves. When they transfer personal data to you, it is transferred to a third country and subject to Chapter V of the GDPR. The EU-U.S. Privacy Shield Framework is subject to an adequacy decision recognised pursuant to Art. 45(9) GDPR.
The above would suggest that as the contracting party to whom the controller transfers personal data, irrespective of your use of sub-processors, you must self-certify under Privacy Shield. You will also need to provide an executable (signable) data protection addendum to your terms for EU (and EEA, UK, etc.) clients, and you should be prepared to disclose the identity of your sub-processors. Bear in mind Art. 28(4) that imposes the same terms on sub-processors as in the top-level processor contract.
