What is Schrems II?

Schrems II is the name of a ruling from the Court of Justice of the European Union in 2020 that had major consequences for how data may be sent between Europe and the US. The case is named after Austrian lawyer Max Schrems, who brought the challenge. The core is simple to understand: the court found that US authorities can access Europeans' data in ways that are not compatible with GDPR.

The result was that the previous framework "Privacy Shield", which made it easy to move data to the US, was suddenly invalidated. Imagine a bridge between two countries unexpectedly closing — all traffic that went over it had to find a new route. In the same way, every business storing data with US cloud providers had to find new lawful solutions.

The most common routes today are so-called SCC (Standard Contractual Clauses — ready-made contract templates from the EU) or the newer DPF (Data Privacy Framework).

Why is Schrems II important for your business?

Very many businesses use US services without thinking about it — cloud storage, email, analytics tools. Schrems II means you need to know where your data actually ends up and that transfers to the US happen lawfully.

Miss this and you risk breaching GDPR, with fines and lost customer trust as a consequence. Handled correctly, it becomes a reassurance you can demonstrate.

Schrems II in practice

A business storing customer data with a US cloud provider must, after Schrems II, ensure the transfer rests on a valid basis — for example SCC or the provider being certified under DPF.

At ZORC, we help you map where your data is stored and set up solutions that hold up even after Schrems II.