After the Schrems II ruling, can we still use security tools from US companies?

Yes, but you need a valid basis for any transfer of personal data and should know what that basis is for each tool. In Schrems II, the Court of Justice of the EU struck down the Privacy Shield in 2020 and required exporters relying on standard contractual clauses to assess whether the law of the destination country undermines them, adding safeguards where needed. Today a transfer to the US can rely on the EU-US Data Privacy Framework if the recipient takes part in it, or on standard contractual clauses with a transfer impact assessment. Security tools often process IP addresses, device names and user names, which are personal data. For each tool, find out where data goes, which legal basis the vendor uses, whether the company takes part in the Framework, and how you would replace it if that basis fell away again. NetSenX stores customer data in the EU. Its data processing agreement lists the sub-processors and states plainly that some are established outside the EEA, for example US-incorporated companies, and that those transfers rely on standard contractual clauses or the Data Privacy Framework.

General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.

← All 20 questions on Data residency and trustAll topics