Cloudflare moves data about EU and UK users to the United States using legal frameworks called the EU-US Data Privacy Framework and Standard Contractual Clauses, which are EU-approved mechanisms designed to protect your data during cross-border transfers.
Your personal data as an EU or UK user is transferred to US servers, and your protections depend on Cloudflare maintaining its Data Privacy Framework certification — a framework that has previously been invalidated and could face future legal challenges.
Cross-platform context
See how other platforms handle International Data Transfers and similar clauses.
Compare across platforms →EU and UK users' personal data is transferred to the US, and the adequacy of legal protections for that data depends on Cloudflare's continued compliance with DPF certification requirements and the stability of the underlying legal framework.
REGULATORY FRAMEWORK: International data transfers are governed by GDPR Chapter V (Arts. 44–49), specifically Art. 45 (adequacy decision) for DPF transfers and Art. 46(2)(c) for Standard Contractual Clauses (2021 SCCs). The EU-US DPF was adopted by the European Commission on July 10, 2023 (Implementing Decision C(2023) 4745). UK transfers are governed by the UK GDPR and the UK-US Data Bridge. Swiss transfers fall under the revised Federal Act on Data Protection (nFADP). The US DoC and FTC share enforcement authority over DPF compliance.
Compliance intelligence locked
Regulatory citations, enforcement risk, and due diligence action items.
Watcher: regulatory citations. Professional: full compliance memo.