On 3 September 2025 the EU General Court dismissed a challenge to the European Commission's 2023 adequacy decision for the EU-US Data Privacy Framework (DPF). The applicant, Philippe Latombe, filed an appeal to the Court of Justice on 31 October 2025 (Case C-703/25 P). The framework still stands while the appeal is pending, but it has been struck down twice in earlier forms, so many buyers now ask what your backup transfer mechanism is.
If you sell SaaS to European customers, that question will come with a data processing agreement. This guide covers what you will be asked and what to have ready.
What's affected
Most SaaS companies are processors: they handle personal data on behalf of customers, who are the controllers. That role carries specific duties.
Article 28(3) says the processor contract must cover:
| Item | What it means for you |
|---|---|
| Scope and duration | State the data types, data subjects and purpose |
| Documented instructions | Process only on the customer's instructions, including for transfers |
| Confidentiality | Staff with access are bound by confidentiality |
| Security | Meet the measures required under Article 32 |
| Sub-processors | Follow agreed conditions for engaging them |
| Data subject rights | Help the customer respond to requests |
| Assistance | Help with Articles 32 to 36 obligations |
| Deletion or return | At the customer's choice, at contract end |
| Audits | Provide information and allow audits and inspections |
Article 33 sets the breach clock. A controller must notify the supervisory authority "without undue delay and, where feasible, not later than 72 hours after having become aware" of a breach. A processor "shall notify the controller without undue delay after becoming aware" of one. Controllers must also document every breach.
The 72 hour clock belongs to your customer, so the time you take to tell them eats into theirs.
How to check if you're exposed
Answer these questions in writing:
- Which personal data do you process for each product, and for which customers?
- Where is it stored, and which sub-processors touch it?
- Do any of those sit outside the EU or EEA?
- How quickly can you detect and tell a customer about a breach?
- How do you delete or return customer data at contract end?
If you rely on the DPF for a US sub-processor or for your own US entity, check that the company is a participant. If you do not, you need another transfer mechanism.
What to do now
- Publish a sub-processor list with names, purposes and locations, and a way for customers to be told of changes.
- Prepare a standard data processing agreement that follows Article 28(3). Match it to what your product actually does.
- Write down your breach notification commitment. Many controllers ask for a short fixed window. Pick one you can meet at 3 a.m. on a weekend.
- Set up a way to log breach facts: what, when, who, what you did. Article 33(5) expects documentation.
- Build deletion and export into the product, then test them.
- Choose and document a backup transfer mechanism in case the DPF is annulled.
- Check Article 32 measures: encryption, access control, backups, testing. Keep the evidence.
How to avoid this trap
- Do not promise a 72 hour notice to customers. That is the controller's deadline to the regulator. Promise something shorter to the customer.
- Do not add sub-processors silently. The agreement requires an agreed process.
- Do not rely on a single transfer mechanism without a fallback plan.
- Do not sign a customer's data processing agreement without reading the audit clause. Decide how you will satisfy audits: a report, a questionnaire, or a call.
A sample sub-processor table
Publish something like this and keep it current:
| Sub-processor | Purpose | Data | Location |
|---|---|---|---|
| Cloud host | Hosting and backups | All customer content | Region named in the contract |
| Email provider | Transactional email | Names and email addresses | Location stated by the provider |
| Support tool | Customer support tickets | Contact details and ticket text | Location stated by the provider |
Each row should say where the data sits, and the page should say how customers can subscribe to change notices. When a customer asks "who else sees our data?", this table is the whole answer.
Why it matters
GDPR obligations pass through contracts. The customer is accountable to the regulator, and you are accountable to the customer. That is why European buyers send a data processing agreement and a security questionnaire in the same week.
Having the sub-processor list, breach commitment and deletion process in one place turns a stalled deal into a short email. It also makes the transfer question a routine one rather than a surprise.
Try it yourself
Write your own five-line answer to "what happens to our personal data when we leave you?" from the product as it is today. If a step needs a human to remember something, that step is the risk.
A short note on timing: do the exercise before a customer asks. Questionnaires and data processing agreements tend to arrive as part of a purchase, when a slow answer costs you the quarter.
Quick check
Whose deadline is the 72 hours under Article 33?
The controller's, for notifying the supervisory authority. The processor must notify the controller without undue delay.
What is the status of the EU-US Data Privacy Framework challenge?
The General Court dismissed the challenge on 3 September 2025. An appeal to the Court of Justice (C-703/25 P) was filed on 31 October 2025.
Name three things Article 28(3) requires in a processor contract.
Any three of: documented instructions, confidentiality, security measures, sub-processor conditions, help with data subject requests, deletion or return at the end, audit cooperation.
