Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
For EU, EEA, UK, and Switzerland-based processing, McDonald's states it transfers personal information only to countries with an adequate level of protection or under Standard Contractual Clauses based on Commission Implementing Decision (EU) 2021/914, with those mechanisms available upon request.
This analysis describes what McDonald's's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes the legal mechanism McDonald's relies upon for international data transfers from the EU, EEA, UK, and Switzerland, referencing SCCs and adequacy decisions as the primary transfer tools and noting that transfer documentation is available upon request.
Under this clause, personal information of EU, EEA, UK, and Swiss customers may be transferred internationally within the McDonald's Family and to vendors, subject to Standard Contractual Clauses or adequacy protections as described. Customers in these regions may request access to transfer documentation by contacting McDonald's.
Cross-platform context
See how other platforms handle International Data Transfers and Standard Contractual Clauses and similar clauses.
Compare across platforms →Monitoring
McDonald's has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"If we are established in EU/EEA, the UK, or Switzerland, or are otherwise subject to the GDPR or similar laws, we only transfer your personal information to countries that are considered by those laws to provide an adequate level of protection or otherwise where we have established or confirmed that all data recipients will provide an adequate level of data protection, in particular by way of entering into appropriate data transfer agreements based on Standard Contractual Clauses (e.g., Commission Implementing Decision (EU) 2021/914) and other suitable measures, which are accessible from us upon request.Excerpt from McDonald's's Privacy Policy
1. REGULATORY LANDSCAPE: This provision directly engages GDPR Chapter V, which governs transfers of personal data to third countries. The reference to Commission Implementing Decision (EU) 2021/914 identifies the current SCC framework. The EU-U.S. Data Privacy Framework is separately addressed in Section 10 and provides an additional transfer mechanism for transfers to McDonald's US entities. Relevant enforcement authorities include EU national data protection authorities and the European Data Protection Board. 2. GOVERNANCE EXPOSURE: Medium. The document references SCCs and adequacy decisions as transfer mechanisms and states that transfer agreements are available upon request, which is consistent with GDPR transparency requirements. However, the document does not specify which receiving countries or entities rely on which transfer mechanism, which may limit the practical transparency of this disclosure for data subjects or regulators. 3. JURISDICTION FLAGS: EU and EEA jurisdictions create primary compliance exposure. The UK post-Brexit transfer framework (International Data Transfer Agreements) and Swiss data protection law create parallel obligations that the document acknowledges. Transfers to the United States rely on both the DPF (for McDonald's Corporation and McDonald's Global Markets LLC) and SCCs for other recipients. 4. CONTRACT AND VENDOR IMPLICATIONS: Vendor contracts with entities receiving EU personal data should be assessed to confirm SCC execution and compliance with the specific module appropriate to the controller-processor or controller-controller relationship. The document's statement that transfer agreements are accessible upon request implies a documentation obligation that procurement teams should confirm is operationally fulfilled. 5. COMPLIANCE CONSIDERATIONS: Compliance teams should maintain a current transfer impact assessment for each major recipient jurisdiction, ensure SCCs are updated following any invalidation or modification of the applicable decision, and confirm that the DPF certification for McDonald's Corporation and McDonald's Global Markets LLC remains current on the U.S. Department of Commerce registry.
Full institutional analysis
Regulatory citations, enforcement risk, and due diligence action items.
Monitor: same-day alerts on the platforms you choose. Analyst: full institutional analysis.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
This provision establishes the legal mechanism McDonald's relies upon for international data transfers from the EU, EEA, UK, and Switzerland, referencing SCCs and adequacy decisions as the primary transfer tools and noting that transfer documentation is available upon request.
Under this clause, personal information of EU, EEA, UK, and Swiss customers may be transferred internationally within the McDonald's Family and to vendors, subject to Standard Contractual Clauses or adequacy protections as described. Customers in these regions may request access to transfer documentation by contacting McDonald's.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by McDonald's.