Someone commented on one of Pedro’s posts that businesses handling European or Australian customer data should not send it to US servers without SCCs in a DPA.
European privacy law, Australian privacy law, server location, provider access and two acronyms have all been pushed into one sentence. It is a lot of confidence for a sentence that has skipped most of the facts.
There may be a cross-border data transfer to deal with. Before choosing the paperwork, we need to find the transfer.
What are SCCs?
SCC stands for Standard Contractual Clauses. They are prewritten terms approved by the European Commission for certain transfers of personal information outside the European Economic Area.
If a European business sends customer information to a provider in a country that does not have an EU adequacy decision, SCCs are one common way to protect that transfer. They can be included in the provider’s data processing agreement, usually called a DPA.
They are not required for every international arrangement. The European Commission lists several ways to handle international transfers, including adequacy decisions, SCCs and binding corporate rules. Its own guide to SCCs says there is no general obligation to use that particular set of clauses.
For example, the EU has an adequacy decision for US companies that are certified under the EU-US Data Privacy Framework. Information can be transferred to a participating company on that basis, as long as the certification covers the company and the service being used. The European Commission explains that arrangement here.
So no, “US” does not automatically mean “attach SCCs.” It means we have another fact to check.
Follow the information
Imagine a Portuguese business uses a custom booking app. The client owns the accounts. Customer names and bookings are kept in a database with an EU region. Confirmation emails go through an email provider. Payments open a checkout page run by a payment company.
Writing “hosted in Europe” at the top of the project document does not finish the review. The database provider may use companies in other countries. Its support team may be able to access the project from outside Europe. The email provider receives names and email addresses. The payment company receives whatever the customer enters at checkout.
Those are separate data flows. Each provider can have a different agreement and a different reason why the transfer is allowed.
Seeing the name of an American company in the technology list does not tell us that every customer record is sitting in an American office waiting to be inspected. We need to know which service receives which information and who can access it.
The European Data Protection Board says remote access from outside the EEA can count as a transfer. A European storage region can therefore be relevant without answering the whole question.
This is why I keep asking what the app actually stores and which services it uses. Apparently that is less exciting than announcing that the server is American, but it gets us closer to the right answer.
The agreement may already include the clauses
Businesses do not usually need to email every large provider and ask for a special contract with fresh signatures.
Supabase is a good example because we often use it for custom apps. Its published DPA forms part of its terms and includes SCCs for transfers where they apply. It also says that accepting the main agreement has the same effect as signing those clauses.
When the client owns the Supabase account, the agreement is between the client and Supabase. Our job can include showing the client where the DPA is, checking the chosen region and listing the other services that receive information. The same exercise applies to the email, video and payment providers used by that particular app.
The client needs the terms that match the services and transfers involved. It does not need a decorative folder containing every privacy document the internet has ever produced.
Australian data is not covered by EU clauses just because somebody mentioned it
Australia has its own privacy rules. SCCs are an EU mechanism.
If the Australian Privacy Act applies to a business, Australian Privacy Principle 8 generally requires it to take reasonable steps before disclosing personal information to an overseas recipient. The business may also remain responsible for how that recipient handles the information. The Office of the Australian Information Commissioner explains the rule here.
That guidance even distinguishes between information merely passing through an overseas server and information being made available to an overseas recipient. The location of the machine matters, but so does who receives the information and who controls what happens next.
Whether the Australian Privacy Act applies will depend on the business and the situation. If it does, the answer comes from the Australian rules. European and Australian privacy law did not merge because somebody typed them into the same Facebook comment.
Buying existing software does not make this disappear
An established platform also has hosting locations, support staff, subprocessors, email services and integrations. It may already provide the right agreements, which can make the paperwork easier. The business still needs to know what it sends there and which terms cover that use.
This only seems to become an urgent philosophical crisis when the words “custom app” appear.
A focused custom app can make the flow easier to see. The client owns the accounts. We choose the database, email and payment services for a reason. We can document which information each one receives and avoid adding services that the project does not need.
A custom app can still be built badly. Nothing about the word “custom” grants it automatic compliance. The work becomes easier when we review the system that actually exists.
“US servers” is not enough to decide whether SCCs are needed. Neither is “Australian customers,” “hosted in Europe” or the logo of a familiar software company.
Show me the information, where it goes, who can open it and which agreements already apply. Then we can have the legal conversation without making two continents share one imaginary rule.