How do I handle US transfers after Schrems II, with SCCs or the EU-US DPF?

For transfers outside the EEA you need a valid basis. The EU-US Data Privacy Framework works for vendors that joined; otherwise you fall back on Standard Contractual Clauses plus supplementary measures.

Try this first

1. 1List vendors that route data outside the EEA. Cloud, email, marketing, support tooling, all candidates.
2. 2Check whether each vendor is certified under the EU-US Data Privacy Framework. The official list lives at dataprivacyframework.gov.
3. 3Not certified? Use the European Commission Standard Contractual Clauses and run a Transfer Impact Assessment for that specific flow.
4. 4Document supplementary measures: encryption in transit and at rest, key management in the EEA, government-request policy.
5. 5Update your privacy notice so you transparently state which data go where, and on what legal basis.

None of the above fits?

Describe your situation below. We pass your input plus the steps you already saw to our AI and return tailored next-step advice. If it's too risky to DIY, we'll say so.