GDPR International Transfers After Latombe: What "Schrems III" Risk Means for US-Hosted Marketing SaaS

The EU-US Data Privacy Framework (DPF) is valid: the General Court dismissed Philippe Latombe's annulment action on 3 September 2025, and his appeal (C-703/25 P) is pending, with a Court of Justice ruling expected in 2027. Plan as if a "Schrems III" ruling could land without a grace period: map US transfers in your customer data platform (CDP) and marketing stack, sign standard contractual clause (SCC) fallbacks now, and decide which data stays, is mitigated or moves.

Who this is for: DPOs, CTOs and marketing-operations leads running EU customer data on US-headquartered software, who need a plan that works whichever way the Court rules. Part of the regulation hub.

Where the EU-US Data Privacy Framework stands

The DPF rests on Commission Implementing Decision (EU) 2023/1795 of 10 July 2023, which allows personal data to flow to certified US organizations without further authorization 4. It is the third US framework. The Court of Justice struck down Safe Harbour in Schrems I (C-362/14, 6 October 2015) and Privacy Shield in Schrems II (C-311/18, 16 July 2020) 3.

What the General Court held. The DPRC (Data Protection Review Court) has safeguards for its members' independence: judges can be dismissed only by the Attorney General and only for cause. On bulk collection, nothing in Schrems II requires prior authorization by an independent authority; ex post review by the DPRC is enough. The judgment confirms adequacy on the date the decision was adopted, and notes that the Commission must monitor continuously and may suspend, amend or repeal the decision if US law changes 3.

What the appeal argues. Four grounds 1: the rules for appointing and dismissing DPRC judges fall short of fair-trial guarantees; independence was judged from operating rules without examining the formal nature of the instrument creating the court; the reasoning on bulk collection and prior authorization was wrong; and the reasoning on the President's power to update bulk-collection objectives under Executive Order 14086 was inconsistent. Latombe asks the Court to annul the decision or, alternatively, to send the case back to the General Court.

What a "Schrems III" ruling would change

Schrems II is the template 6:

• No grace period. The Court declared the Privacy Shield decision invalid without limiting its effects, and held that annulment would not create a legal vacuum because GDPR Article 49 remains (para. 202; operative point 5).
• SCCs survived, with conditions. Exporter and importer must verify before each transfer that the level of protection is respected; the importer must report inability to comply; the exporter must then suspend or terminate. Supervisory authorities must suspend or prohibit transfers where SCCs cannot be complied with and protection cannot be ensured otherwise.
• The test is "essentially equivalent" protection, judged on both the contract and the third country's legal system, including public-authority access.

The current SCCs (Decision 2021/914) hard-wire those duties: Clause 14 requires a documented assessment of local laws (a transfer impact assessment, or TIA), available to the supervisory authority on request; Clause 15 requires the importer to notify, challenge unlawful requests and disclose the minimum; Clause 16 requires suspension and permits termination 7.

While an adequacy decision stands, national authorities are bound by it, so a fresh national complaint does not change anything until the Court of Justice rules 6.

Transfer plan for US-hosted marketing and customer-data SaaS

1. Inventory every transfer

The European Data Protection Board (EDPB) puts "know your transfers" first, and remote access counts as a transfer 8. In a marketing stack, look beyond the headline vendor:

• The CDP, email service provider, CRM and support suite, including US parent-company access to an EU-hosted tenant.
• Sub-processors: hosting, content delivery, SMS and email delivery, analytics.
• Server-side tagging and conversion APIs that send hashed identifiers to ad platforms (see Google Analytics and GDPR).
• Large language model APIs receiving prompts that contain customer data.
• Agencies, contractors and follow-the-sun support teams in the US.
• Backups and disaster-recovery regions.

For each: vendor, entity, location, data categories, volume, transfer tool, sub-processors, and whether the importer needs data in the clear.

2. Compare the transfer tools

Check certification on the official list at dataprivacyframework.gov and keep dated evidence.

3. Put fallbacks and exit rights in vendor contracts now

• SCCs executed by reference with the right module, complete annexes and automatic effect if the DPF falls.
• A warranty of active DPF certification and notice within days of lapse.
• Sub-processor list with locations, advance notice of changes and a right to object.
• A commitment to process in an EU region on request, or to offer one.
• Government-access terms mirroring SCC Clause 15: notice, challenge, minimization.
• Encryption and key-management terms (below).
• Vendor support for your TIA: legal assessment, transparency reports, change-of-law notices.
• A right to suspend or terminate without penalty if the transfer becomes unlawful.
• Export in open formats within a fixed time, with erasure certificate (see EU Data Act cloud switching and the cloud exit template).
• Audit and incident duties for access requests.

4. Use in-region processing, EU-held keys and minimization honestly

5. Write a marketing transfer impact assessment you can maintain

A TIA records: the transfer and purpose; data categories and sensitivity; importer and sub-processors; whether data are processed in the clear; relevant US laws and practices, including the Commission's DPF findings; safeguards in place; conclusion; owner; and review date. EDPB step 6 requires ongoing monitoring and prompt suspension if the tool stops working 8. Keep it to two pages per vendor and update it on any court or Commission event.

A 90-day plan

• Days 1 to 30: complete the transfer inventory; confirm DPF status and SCC annexes for every US vendor.
• Days 31 to 60: draft TIAs for the top five vendors by data sensitivity; negotiate the fallback and exit clauses.
• Days 61 to 90: run one export test; decide stay, mitigate or relocate per tier; set review triggers (Court of Justice hearing, ruling, Commission review).

Stay, mitigate or relocate: decision table by data sensitivity

If you are choosing where customer profiles should live before the Court rules, a residency architecture review compares on-premise, private cloud and EU-operated options against your data tiers. More playbooks are in the regulation hub; see also the GDPR-ready deployment page.