On 3 September 2025 the EU General Court dismissed a challenge to the EU-US Data Privacy Framework adequacy decision (Case T-553/23, Latombe v Commission). On 31 October 2025 the applicant appealed to the Court of Justice as Case C-703/25 P, and the Official Journal published the notice on 22 December 2025. If you answer European customers' data residency questions, your transfer mechanism is a live legal topic, so your answer should not depend on a single mechanism.
What's affected
The European Commission adopted its adequacy decision for the Data Privacy Framework on 10 July 2023. On that basis, personal data can flow freely from the EU to US companies that participate in the Framework. The appeal asks the Court of Justice to set aside the General Court's judgment and annul that decision. Check the Court's own site for the current status before you quote it to a customer.
"Data residency" is often asked as one question but means three:
- Storage: which region holds primary data, backups and logs.
- Processing: where code runs, including support tooling and analytics.
- Access: who can read the data, from which country, including your own staff.
What to do now
- Write a one page data map with those three rows for each product component.
- State regions by name, such as "primary storage in Frankfurt, backups in Ireland".
- List which subprocessors receive customer data and where they operate.
- Name your transfer mechanisms for each flow: adequacy, standard contractual clauses under GDPR Article 28(6) to (8) and Chapter V, or none because data stays in region.
- Offer a fallback. If a customer's contract depends on Framework certification, say what you would do if it fell, such as switching to standard contractual clauses.
- Keep logs, backups and support exports in the same map. They are where residency commitments usually break.
How to avoid this trap
The trap is answering "EU" when you mean "primary database". A log aggregator in another region, or a support engineer reading data from another country, can contradict a residency promise. Check the real flows, not the architecture slide.
Do not promise "data never leaves the EU" unless you have verified every flow, including backups and error tracking.
Quick check
What three things does a residency question usually cover?
Storage, processing and access.
