Many ad tools and platforms process data on servers outside the EU. This requires specific safeguards to protect people’s data. For advertisers, it pays to know where the data goes, which mechanisms legitimise that transfer and how to document the decision.
The essentials in a definition
Transfers of data outside the EU occur when campaign tools and platforms process or store data in other countries. The GDPR sets conditions for such transfers, and the EDPB and European Commission publish guidance and decisions. It pays to check where data are held, each supplier’s transfer basis and additional measures, and to document.
Why it is an issue
EU data-protection rules apply to the data of people in the EU, even when processed in another country. Transfer outside the European area is only allowed if there are adequate safeguards. When the safeguards change (adequacy decisions, contractual mechanisms), obligations do too.
Ad platforms, analytics, email and CRM often involve servers outside the EU.
What mechanisms exist
Adequacy decisions (countries or frameworks recognised as offering equivalent protection), standard contractual clauses and supplementary measures, and other safeguards. Many suppliers publish their documentation and certifications. Check which applies to the specific supplier.
The situation evolves: follow updates.
Checking data transfers outside the EU
- Inventory tools and data location
- Read the supplier’s documentation
- Confirm the transfer mechanism
- Minimise data and document
What the advertiser should do
Inventory the tools that process personal data and where. Read each supplier’s privacy documentation. Check the transfer mechanism. Minimise the data sent (for example avoid sending personal data when not needed). Inform data subjects in the privacy policy. Record the assessment.
For complex cases, seek legal support.
Knowing where data goes is the first step to protecting it.
Good practice
Prefer configurations with data in the EU, where they exist and are suitable. Use pseudonymisation and encryption. Limit access. Reassess suppliers periodically. Have a plan to switch supplier if necessary.
Document everything: it eases audits and responses to data subjects.
Decision table
| Check | Question | Document |
|---|---|---|
| Data location | Where are they processed and stored? | Supplier terms and list of sub-processors |
| Transfer basis | Is there an adequacy decision, clauses or another mechanism? | Processing agreement |
| Additional measures | Are there encryption, minimisation and access control? | Description of measures |
| Information to data subjects | Does the privacy policy mention transfers? | Updated policy |
Common mistakes to avoid
- Assuming all tools comply. Check each supplier.
- Sending more data than necessary. Minimise before sending.
- Not following changes. Rules and suppliers change.
How to measure the result
Keep a supplier register with location, transfer basis and review date, and track changes to terms.
Limits and exceptions
The framework for international transfers is complex and evolving, with decisions and guidance that change, so this content is informational and does not replace legal advice. In relevant cases, seek specialist support and review compliance periodically.
Illustrative example
Illustrative example: a company inventories its marketing tools and checks where each processes data, the transfer basis and measures. It finds a dashboard tool without a suitable agreement and replaces it. It updates the privacy policy and processing record, and starts reviewing the supplier list once a year.
In practice: checkpoints
Identify all the services in your stack that send data outside the EU, check the transfer mechanism each provider relies on and the safeguards in the contract. Record the assessment, ask providers about their data locations and subprocessors, and review when laws or providers change. Where risk is high, consider alternatives or additional measures, and make sure your privacy notice describes the transfers truthfully. Keep this review in the audit calendar, and ask for legal advice when the situation is complex or involves sensitive data.
Frequently asked questions
Can I use tools with servers outside the EU?
Yes, if there are adequate safeguards. Check each supplier’s mechanism.
How do I minimise risk?
By sending only necessary data and using pseudonymisation.
Do I need legal support?
In complex cases, it is recommended.
Are all transfers prohibited?
No; they are permitted with adequate mechanisms and safeguards, under applicable rules.
How do I check a supplier?
By reading processing terms, the sub-processor list and asking for documentation of safeguards.
Check where each campaign tool processes data, the transfer basis and additional measures, and document and inform data subjects.
Sources and recommended reading
- General Data Protection Regulation (GDPR)
- European Data Protection Board (EDPB)
- European Commission: data protection
Last editorial review: October 2026. Informational content; always confirm current conditions in the official sources before deciding.