A document pasted into an assistant almost always crosses the Atlantic, because almost every large model is there. Chapter V of the GDPRopens in a new tab deals with this, and its structure is simpler than it looks: first you establish whether there is a transfer, then you find the instrument that supports it.
When there is a transfer
There is one when data is made available to someone in a third country, and it does not turn on where the data physically “ends up”. A European supplier relying on an American model produces a transfer even though its invoice comes from Dublin.
That is why the useful question for a supplier is not “where are your servers” but “who are your sub-processors, by name, and where are they”. The first always has a reassuring answer; the second has a true one.
Three instruments, in order of solidity
The first is an adequacy decision under Article 45: the Commission finds that a country or framework offers an adequate level of protection, and the transfer needs nothing further. For the United States the Data Privacy Frameworkopens in a new tab has existed since 2023, extended to the European Economic Area in 2024, and it covers American companies that have joined it and appear on the public list. Anyone not on that list is not covered, and the list can be checked.
The second is the standard contractual clauses under Article 46: a contract approved by the Commission binding the importer to equivalent safeguards. They are not enough on their own: they come with a transfer impact assessment that looks at the law of the destination country and, where needed, adds supplementary measures.
The third is the derogations in Article 49: explicit consent, contractual necessity, the establishment or exercise of legal claims. They are designed for occasional cases and do not support daily use, which is exactly the use a firm makes of an assistant.
The transfer impact assessment, on one page
The acronym you meet in contracts is TIA, and it frightens people more than it costs: in the form the European Board recommends it is six steps, and for a professional firm they fit on a page. It is worth writing once, because it comes out identical for every supplier that arrives afterwards.
One. Map the transfer: what data leaves, about whom, to which company and which country, and through which sub-processors. Two. Name the instrument it rests on: adequacy, standard clauses, derogation. Three. Assess whether the law of the destination country actually lets that instrument work, looking in particular at public authorities’ powers of access. Four. Where something does not add up, add supplementary measures: encryption with keys that stay in Europe, minimisation, pseudonymisation upstream. Five. Check those measures are compatible with how the service actually works: encryption the supplier has to undo in order to process the text is not a supplementary measure. Six. Review at intervals, because the law of the destination country changes without warning.
Step four is where a technical choice made earlier turns into a line of compliance: if the text that leaves already carries placeholders in place of the identifying values, the risk steps three and five have to weigh is an order of magnitude smaller. It is not a shortcut (the assessment still has to be done), but it is the difference between an assessment that closes and one that stays open.
“The servers are in Europe” is not the answer
It is the sentence that ends more conversations than any other, and it is the one to open. “European region” describes where the data rests; Chapter V is about who reaches it. A service hosted in Frankfurt whose second-line support sits in California, or whose monitoring is run by the parent company, produces a transfer every time that access is possible, not only when it happens.
There are suppliers for whom the answer really is European, though, and over the last few years that has become a real market: models trained and hosted in the Union, and open models you can run on a machine of your own. The second case closes the question rather than answering it: a model running on the computer of the person doing the work transfers nothing to anybody, because there is no recipient. The cost moves elsewhere (the machine’s capacity, updates, how the model compares with the largest ones), which is a different bill, not an absent one. The two routes side by side are in their own piece.
Why not to rest everything on the first
Adequacy decisions towards the United States have a history: two earlier frameworks were annulled by the Court of Justice. The Data Privacy Framework is in force and at the same time contested: a US Supreme Court decision on the independence of the Federal Trade Commission has raised doubts about one of the premises the adequacy finding rests on.
This is not a prediction, it is a practical reason not to build an entire arrangement on a single instrument. Anyone who also has standard contractual clauses and a written assessment has nothing to redo on the day something changes.
The route that removes the question
All of this chapter applies to personal data. Text whose identifying values were substituted before it left shrinks the surface of the problem enormously, and this is where the distinction between pseudonymisation and anonymisation has to hold: pseudonymised data is still personal data, so the transfer rules do not disappear.
There is one step the Court of Justice has made clearer, though, and it bears exactly on this. In its judgment of 4 September 2025 in Case C-413/23 Popens in a new tab the Court held that whether something is personal data has to be assessed from the recipient’s point of view as well: where the recipient has no means reasonably likely to be used to get back to the individuals, that material may not be personal data for them. Applied to a transfer, that is the difference between sending a case file and sending a text only you hold the key to.
So what changes, and changes a great deal, is what gets transferred: no longer a filing carrying names, tax codes and IBANs, but text where those values are placeholders and the mapping stayed encrypted on the machine where the work happens, where no supplier can read it. The difference between the words is in the piece about the EDPB opinion; the choice between local and cloud, which is the one that decides, is in the other.