Sending personal data to the US from Ireland, in 2026

The question this answers: are we allowed to use an American tool or supplier, such as a CRM, a helpdesk, an email platform, an AI model provider or a hosting company?

The short answer: transfers to the United States are lawful under an adequacy decision. That is a European Commission decision that data sent to companies in the EU-US Data Privacy Framework is adequately protected. It survived its first court challenge in September 2025. The work is in three checks.

Chapter V of the GDPR governs transfers of personal data to countries outside the EEA, and it offers a ladder.

Article 45 is adequacy. Where the Commission has decided that a country ensures an adequate level of protection, no further authorisation is needed. The United States is on the adequacy list for organisations participating in the EU-US Data Privacy Framework.

Article 46 is appropriate safeguards. The usual one is the standard contractual clauses, model contract terms adopted by Commission Implementing Decision (EU) 2021/914. They remain the answer for any US recipient not covered by the Framework, and they come with a transfer impact assessment attached.

Article 49 allows exceptions (derogations) for specific situations: explicit consent, necessity for a contract, important reasons of public interest, legal claims and vital interests. The European Data Protection Board's guidelines say clearly that these must be read narrowly, so that the exception does not become the rule. They are not a route for a regular business transfer.

The adequacy decision is Commission Implementing Decision (EU) 2023/1795 of 10 July 2023. It is in force and has not been annulled, suspended or repealed.

It was challenged. In Case T-553/23, Latombe v Commission, the General Court dismissed the action on 3 September 2025. An appeal was lodged and appeals of this kind do not suspend the decision.

The point that matters for business: the General Court judged adequacy as it stood on the date the decision was adopted. The judgment shows the Framework was validly adopted. It is not a ruling that the arrangements are sound today.

The Commission's first periodic review reported in October 2024 that the US authorities had put in place the necessary structures and procedures. The Commission moved to a three-year review cycle, so the next scheduled review is not due until around October 2027.

Relying on adequacy means establishing that this recipient is covered for this data.

Sending employee data to a US supplier, a payroll platform or a group parent has its own rule.

The European Data Protection Board's guidance for businesses sets it out as a test that can be met in two ways. The US organisation can hold an active certification that covers the data as HR data. Or it can hold an active certification that covers it as another type of personal data, and have committed in its privacy policy to cooperate with EU data protection authorities.

You have a duty too, as the one sending the data (the exporter). You have to tell the US organisation that the transfer includes HR data.

This is the part that turns a transfer question into a compliance gap, and it is short.

Adequacy answers Chapter V. It does not give you a lawful basis for the processing under Article 6. It does not meet your duty to tell people about the processing under Articles 13 and 14. And it does not remove the need for a written agreement with each supplier that processes the data for you (a processor agreement, under Article 28). A certified US processor still needs a data processing agreement with the required clauses in it.

On that last point, the Data Protection Commission's decision against a small credit union found infringements of both Article 28(1) and Article 28(3), as well as the security failure. The processor paperwork was part of what the decision found missing.

Your privacy notice also has to say this out loud. Article 13(1)(f) requires it to say that you intend to send data outside the EEA, whether there is an adequacy decision, and, where there is not, the safeguards you rely on. Check yours says it.

Use standard contractual clauses under Article 46, plus a transfer impact assessment. That is the document that asks whether the law of the destination country undermines the clauses in practice, and what extra measures you have put in place.

One gap: the Commission has still not adopted the additional set of clauses for importers that are themselves directly subject to the GDPR under Article 3(2). Its own page continues to describe them as in development.

In practice, for an Irish small business: use the Framework where the supplier is on the list, and the standard contractual clauses where it is not. Keep the Article 49 exceptions for a one-off transfer, not a regular flow of data.

The same ladder applies to a model provider, and the questions do not change: is the legal entity certified, does the certification cover this data, is there a processor agreement, and does the privacy notice say so.

What does change is how much data goes across, and how sensitive it is, because whatever an employee types goes to the model. That is the reason for the rule about confidential and personal data in an AI literacy note.