For users in the EU, UK, or Switzerland, Visa uses Standard Contractual Clauses (SCCs) and other safeguards when transferring personal data outside those regions, as required by GDPR and related laws.
If you are in the EU or UK, your personal data is transferred to the U.S. under Standard Contractual Clauses, but the adequacy of these protections in practice depends on Visa's supplementary measures and compliance with the EU-U.S. Data Privacy Framework.
Cross-platform context
See how other platforms handle GDPR and International Data Transfers and similar clauses.
Compare across platforms →International data transfers from the EU/UK to the U.S. carry regulatory scrutiny, and SCCs alone may not fully protect consumer data if U.S. surveillance laws allow government access — a concern highlighted by post-Schrems II jurisprudence.
REGULATORY FRAMEWORK: This provision implicates GDPR Chapter V (Arts. 44–49) governing international data transfers, specifically Art. 46(2)(c) standard contractual clauses (SCCs) as adopted by the European Commission in 2021 (Implementing Decision (EU) 2021/914). The EU-U.S. Data Privacy Framework (DPF, adopted July 2023, Commission Implementing Decision (EU) 2023/1795) provides an adequacy mechanism for U.S.-based organizations. The UK International Data Transfer Agreement (IDTA) applies for UK transfers. Swiss Federal Act on Data Protection (revFADP) applies for Switzerland. Enforcement authority rests with EU member state DPAs, the UK ICO, and the Swiss FDPIC.
Compliance intelligence locked
Regulatory citations, enforcement risk, and due diligence action items.
Watcher: regulatory citations. Professional: full compliance memo.