DeepL may send your personal data to service providers in the US and other countries outside the EU, but uses standard legal contracts (SCCs) to try to ensure your data stays protected.
Your personal data processed by DeepL may be transferred to and processed in the United States or other countries with different privacy standards, protected only by contractual safeguards that may be subject to US government access requests.
Cross-platform context
See how other platforms handle International Data Transfers and Standard Contractual Clauses and similar clauses.
Compare across platforms →Transfers of personal data to the US and other non-adequate countries carry inherent legal risk, and the effectiveness of SCCs depends on a case-by-case Transfer Impact Assessment that users cannot independently verify.
(1) REGULATORY FRAMEWORK: International transfers are governed by GDPR Chapter V, specifically Arts. 44–49. SCCs are authorized under Commission Implementing Decision (EU) 2021/914. The EU-US Data Privacy Framework (adequacy decision, July 2023) may also apply to US-based processors that are DPF-certified. UK transfers require UK SCCs (IDTA) or the UK Addendum. Enforcement is by LDI NRW and member state DPAs. (2)
Compliance intelligence locked
Regulatory citations, enforcement risk, and due diligence action items.
Watcher: regulatory citations. Professional: full compliance memo.