Sending personal data to the US from Ireland, in 2026

Almost nobody asks this in the abstract. It arrives as: we want to use this American tool, is that allowed. The tool is a CRM, a helpdesk, an email platform, a model provider or a hosting company, and the person asking has already been told by somebody that Schrems II made it illegal.

The short answer is that transfers to the United States are lawful under an adequacy decision, that the adequacy decision survived its first annulment action in September 2025, and that the work is in three checks rather than in a legal argument.

Chapter V of the GDPR governs transfers of personal data to countries outside the EEA, and it offers a ladder.

Article 45 is adequacy. Where the Commission has decided that a country ensures an adequate level of protection, no further authorisation is needed. The United States is on the adequacy list for organisations participating in the EU-US Data Privacy Framework.

Article 46 is appropriate safeguards, of which the standard contractual clauses adopted by Commission Implementing Decision (EU) 2021/914 are the ordinary route. These remain the answer for any US recipient not covered by the Framework, and they come with a transfer impact assessment attached.

Article 49 is derogations for specific situations: explicit consent, necessity for a contract, important reasons of public interest, legal claims, vital interests. The European Data Protection Board's guidelines are unambiguous that these must be interpreted restrictively so that the exception does not become the rule. They are not a route for a recurring business transfer.

The adequacy decision is Commission Implementing Decision (EU) 2023/1795 of 10 July 2023. It is in force and has not been annulled, suspended or repealed.

It was challenged. In Case T-553/23, Latombe v Commission, the General Court dismissed the action on 3 September 2025. An appeal was lodged and appeals of this kind do not suspend the decision.

The nuance that matters commercially, and that gets lost in the headlines: the General Court assessed adequacy as at the date the decision was adopted. It is authority that the Framework was validly adopted. It is not a ruling that the arrangements are sound today.

The Commission's first periodic review reported in October 2024 that the US authorities had put in place the necessary structures and procedures. The Commission moved to a three-year review cycle, so the next scheduled review is not due until around October 2027.

Relying on adequacy is not a matter of believing that America is fine. It is a matter of establishing that this recipient is covered for this data.

Sending employee data to a US supplier, a payroll platform or a group parent is the case where this most often goes wrong, and the common summary of the rule is too strict.

The European Data Protection Board's guidance for businesses sets it out as a two-limb test. The US organisation must either hold an active certification that covers the data as HR data, or hold an active certification covering it as another type of personal data and have committed in its privacy policy to cooperate with EU data protection authorities.

There is also a duty on you rather than on them. The exporter has to tell the US organisation that the transfer includes HR data.

This is the part that turns a transfer question into a compliance gap, and it is short.

Adequacy answers Chapter V. It does not supply a lawful basis under Article 6, it does not satisfy the transparency duties in Articles 13 and 14, and it does not remove the need for a written processor agreement under Article 28. A certified US processor still needs a data processing agreement with the required clauses in it.

That last one is not theoretical in Ireland. The Data Protection Commission's decision against a small credit union found infringements of both Article 28(1) and Article 28(3) alongside the security failures, and the processor paperwork was the part nobody had looked at.

Your privacy notice also has to say this out loud. Article 13(1)(f) requires you to state the intended third country transfers, whether there is an adequacy decision, and the safeguards relied on where there is not. Most Irish notices do not.

Standard contractual clauses under Article 46, plus a transfer impact assessment, which is the document that asks whether the law of the destination country undermines the clauses in practice and what supplementary measures you have applied.

One gap worth knowing about before anybody promises a client otherwise: the Commission has still not adopted the additional set of clauses for importers that are themselves directly subject to the GDPR under Article 3(2). Its own page continues to describe them as in development. Commentary that quoted a 2025 target for them was reporting an intention rather than an instrument.

The practical order for an Irish SME is: use the Framework where the supplier is genuinely on the list, fall back to clauses where it is not, and treat Article 49 derogations as what they are, which is a route for the one-off rather than for the pipeline.

The same ladder applies to a model provider, and the questions do not change: is the legal entity certified, does the certification cover this data, is there a processor agreement, and does the privacy notice say so.

What does change is the volume and the sensitivity of what goes across, because the input to a model is whatever an employee typed. That is the argument for the rule about confidential and personal data in an AI literacy note, which is the cheapest control available and the one most often skipped.