RGPD LLC US clients UE 2026 : 3 transfer mechanisms (EU-US Data Privacy Framework + DPA Article 28 + SCC Standard Contractual Clauses), Schrems II Transfer Impact Assessment, UK GDPR IDTA.
LLC US doit GDPR compliance dès targeting/monitoring EU residents (Article 3 territorial scope). 3 transfer mechanisms valides : (1) EU-US Data Privacy Framework (DPF) self-certification Department of Commerce (établie juillet 2023, replace Privacy Shield invalidé Schrems II 2020), (2) DPA (Data Processing Agreement) GDPR Article 28 avec 8 critical components, (3) SCC (Standard Contractual Clauses) fallback + Transfer Impact Assessment post-Schrems II. UK GDPR séparé requires IDTA addendum (sauf DPF reconnu UK 2023). Penalties Article 83 : €20M ou 4 % global revenue (whichever higher). Ce guide cornerstone EU data protection détaille 3 mechanisms + DPF self-cert + DPA + SCC + Schrems II — rédigé par notre avocat Jean Dupont, Barreau de Paris + JD Cornell Law, et +180 000 LLC accompagnées par USINCO depuis 2004.
GDPR LLC clients UE : ce qu'il faut savoir (3 mécanismes)#
Le RGPD/GDPR (Règlement Général sur la Protection des Données) s'applique aux LLC US dès qu'elles ciblent ou monitorent EU residents. Pour LLC USINCO francophones non-résidents servant clients UE, compliance GDPR est non-négociable.
« Companies must ensure they can commit to annual recertification and ongoing compliance » with framework principles including notice, choice, accountability, security, access rights, dispute resolution mechanisms.
— GDPR Local cabinet compliance EU-US
« Controllers determine processing purposes and means — what data gets collected and why. Processors execute instructions on the controller's behalf — handling, storing, or analyzing that data through their services. »
« Any third party with access to personal data is a subprocessor. You remain fully liable for subprocessor failures. »
— Secure Privacy SaaS DPA specialist
PROCESSING INSTRUCTIONS. Processor shall process Personal Data only
in accordance with Controller's documented instructions, including
those set forth in this DPA, the Main Agreement, and any subsequent
written instructions provided by Controller.
SECURITY MEASURES. Processor shall implement appropriate technical
and organizational measures to ensure a level of security
appropriate to the risk, including:
(a) pseudonymization and encryption of Personal Data;
(b) ongoing confidentiality, integrity, availability of systems;
(c) ability to restore data after incident;
(d) regular testing of security measures;
(e) compliance with industry standards (ISO 27001, SOC 2 Type II).
BREACH NOTIFICATION. Processor shall notify Controller without undue
delay (and in any event within seventy-two (72) hours) after becoming
aware of a Personal Data Breach. The notification shall include:
(a) nature of breach (categories + approximate number of data
subjects + records affected);
(b) likely consequences;
(c) measures taken to address breach;
(d) Data Protection Officer (DPO) contact information.
US surveillance laws (FISA Section 702 + Executive Order 12333) violate fundamental rights GDPR (data minimization, proportionality, judicial redress).
TIA obligatoire si SCC utilisé (vs DPF self-certification = pas TIA requise). Recommandation USINCO : DPF self-certification preferred pour éviter TIA complexity.
Quelle est la part de vos utilisateurs / clients europeens (UE + EEE) ?
Questions frequentes
Les reponses aux questions les plus posees sur ce sujet.
**OUI, GDPR s'applique aux LLC US** dès targeting/monitoring EU residents (Article 3 territorial scope du GDPR). Mécanisme : peu importe où LLC est établie (Wyoming, Delaware, NM), GDPR applies si LLC : (1) **offre goods/services aux EU residents** (e-commerce DTC, SaaS B2C, services consultants), (2) **monitors behavior** EU residents (analytics, tracking, profiling), (3) **processes personal data** d'EU residents. **3 transfer mechanisms valides** pour data US-EU : (a) **EU-US Data Privacy Framework (DPF)** — self-certification Department of Commerce établie juillet 2023 (replace invalidated Privacy Shield), implementation 2-4 weeks, annual re-cert. (b) **DPA (Data Processing Agreement)** GDPR Article 28 — 8 critical components obligatoires. (c) **SCC (Standard Contractual Clauses)** — fallback si DPF invalidé + Transfer Impact Assessment post-Schrems II. **Penalties GDPR Article 83** : **€20M ou 4 % global revenue** (whichever higher).
L'**Article 3 GDPR (Territorial scope)** étend l'application du GDPR au-delà du territoire UE pour couvrir entités étrangères ciblant EU residents. **2 critères principaux** : (1) **Article 3(2)(a) — Offering goods/services** : LLC US offre goods/services aux EU residents (même gratuits — ex : free SaaS trial). Indicateurs : language EU (FR/DE/IT/ES), currency EUR/GBP, top-level domain EU (.fr/.de), shipping EU, customer reviews EU. (2) **Article 3(2)(b) — Monitoring behavior** : LLC US monitors EU residents' behavior dans UE. Indicateurs : analytics tracking, behavioral profiling, location tracking, cookies tracking. **NON applicable si** : LLC US accepte occasionnellement EU customers without targeting, no analytics, no EU-specific marketing. **Pour LLC USINCO francophones** : majorité applicable (clients FR/BE/CH/CA + analytics + targeting linguistique). **Conséquence** : GDPR compliance obligatoire (DPA + SCC ou DPF + Privacy Policy mise à jour). **EDPB Guidelines 03/2018** détaillent application Article 3.
L'**EU-US Data Privacy Framework (DPF)** est **self-certification mechanism** établi juillet 2023 qui permet aux US companies de transfer EU data légalement sans additional protections. Replace invalidated Privacy Shield (CJUE Schrems II 2020). **Eligibility** : US companies subject to investigatory/enforcement powers of FTC (Federal Trade Commission) OU DoT (Department of Transportation). **Self-certification process** : (1) **Assess organizational eligibility** + data transfer requirements, (2) **Complete self-certification** with US Department of Commerce, (3) **Maintain ongoing compliance** through annual re-certification. **Duration** : 2-4 weeks implementation. **Cost** : Medium ($300-1 500/an typical compliance support). **Citation GDPR Local** : *« companies must ensure they can commit to annual recertification and ongoing compliance »* with framework principles including **notice, choice, accountability, security, access rights, dispute resolution mechanisms**. **Pour LLC USINCO francophones non-résidents** : DPF accessible (LLC = US company subject to FTC) — recommandé pour SaaS B2B + e-commerce avec EU clients.
Le **DPA (Data Processing Agreement)** GDPR Article 28 est **obligatoire** entre controller (client EU) + processor (LLC US). **8 critical components obligatoires** selon GDPR Register : (1) **Controller Instructions** — *« processor may only process personal data in line with the controller's documented instructions »*. (2) **Confidentiality** — processor ensures staff handling data are bound by confidentiality duties. (3) **Security Measures** — technical/organizational protections per Article 32 GDPR. (4) **Sub-processor Controls** — prior written consent required before engaging sub-processors. (5) **Data Subject Rights Support** — assists controller in responding to individual access requests (Article 15-22 GDPR). (6) **Breach Cooperation** — helps notify authorities + affected individuals of breaches (Article 33-34). (7) **Data Deletion/Return** — removes or returns personal data upon contract termination. (8) **Audit Rights** — permits controller inspections + provides compliance documentation. **Pour LLC USINCO francophones SaaS B2B** : DPA template obligatoire dans tous contracts clients UE — typically attached as Exhibit/Schedule to Master Services Agreement (MSA).
Les **SCC (Standard Contractual Clauses)** sont **clauses-types approuvées par EU Commission** pour data transfers vers pays third (non-adequacy). Servent de **fallback** si EU-US Data Privacy Framework (DPF) invalidé ou non applicable. **2 sets SCC actuels (June 2021)** : (1) **Module 1** — Controller to Controller transfers, (2) **Module 2** — Controller to Processor, (3) **Module 3** — Processor to Processor, (4) **Module 4** — Processor to Controller. **Conditions enforceability** : (a) **Schrems II compliance** (CJUE C-311/18, 2020) — **Transfer Impact Assessment (TIA)** obligatoire pour évaluer si lois locales US compatibles GDPR, (b) **Supplementary measures** si TIA reveals risks (encryption, pseudonymization, contractual safeguards). **Cas pratique LLC USINCO** : si DPF self-certification non choisie, LLC doit signer SCC Module 2 (Controller-to-Processor) avec chaque client EU + conduct TIA documenté. **Durée setup SCC** : 1-2 weeks (vs DPF 2-4 weeks). **Certainty Medium** vs DPF High. **Recommandation USINCO** : DPF preferred (higher certainty) + SCC backup si DPF invalidated futur.
**Schrems II** (CJUE C-311/18, 16 juillet 2020) est l'arrêt landmark qui a invalidé EU-US **Privacy Shield** (predecessor DPF). Décision : US surveillance laws (FISA Section 702 + Executive Order 12333) violate fundamental rights GDPR. Conséquence : data transfers EU-US require **additional safeguards** beyond standard SCC. **Transfer Impact Assessment (TIA)** = analyse documentée évaluant si data transfer protégé adequately compte tenu lois locales destination. **TIA components** : (1) **Identify transfer** (data types + recipient + purpose), (2) **Assess legal framework** (US laws applicable to recipient), (3) **Evaluate effectiveness safeguards** (SCC + supplementary measures), (4) **Implement supplementary measures** si risques (encryption end-to-end, pseudonymization, contract clauses additionnelles), (5) **Document conclusions** et review annually. **Pour LLC USINCO francophones** : TIA obligatoire si utilisation SCC (vs DPF self-certification + DPF presumption adequacy). **Supplementary measures typical** : (a) **End-to-end encryption** (data unreadable même if government access), (b) **Pseudonymization** (data linked to identifiable individual via additional info), (c) **Contractual** safeguards (notification subpoenas + transparency reports).
Le **UK GDPR** (UK General Data Protection Regulation) est **séparé** du GDPR EU depuis Brexit (Janvier 2021). Pour LLC US transferring data **UK residents**, mécanismes spécifiques requis. **Options compliance UK GDPR** : (1) **UK Adequacy Decisions** : UK Government reconnaît adequacy certaines juridictions (DPF reconnu UK 21 sept 2023 — US companies DPF-certified = automatic UK GDPR compliance pour UK transfers). (2) **IDTA (International Data Transfer Agreement)** : UK equivalent SCC, signé entre UK controller + non-UK processor. (3) **UK Addendum to EU SCC** : si LLC US uses EU SCC, peut adopter UK Addendum pour étendre coverage UK. **Recommandation USINCO** : (a) **DPF self-certification** avantageuse — couvre EU + UK simultaneously (post-2023 UK adequacy). (b) Si pas DPF : **IDTA pour UK + SCC pour EU** = 2 documents. **UK GDPR penalties** : **£17.5M ou 4 % global turnover** (whichever higher) — similaires EU GDPR. **Documentation UK** : Privacy Policy mise à jour mentioning UK ICO + IDTA disponible si requested.
Les **penalties GDPR Article 83** sont parmi les plus sévères mondialement : **2 tiers maximum** : (1) **Tier 1 (less severe)** : **€10M ou 2 % global annual turnover** (whichever higher) — violations administrative (records of processing, security measures Article 32, notification breaches). (2) **Tier 2 (most severe)** : **€20M ou 4 % global annual turnover** (whichever higher) — violations fundamental (consent invalid, legal basis missing, data subject rights, international transfers without safeguards). **Factors considered Article 83(2)** : (a) Nature/gravity/duration infringement, (b) Intentional vs negligent, (c) Mitigating actions, (d) Degree of cooperation supervisory authority, (e) Previous infringements, (f) Categories personal data affected, (g) Financial benefit derived. **Enforcement examples 2023-2025** : Meta €1.2B (May 2023 Schrems II violation), TikTok €345M (Sept 2023 children data), Amazon €746M (July 2021), Google €90M (Jan 2022). **Pour LLC USINCO francophones** : même small LLC peut être fined €100K-1M pour GDPR violations majeures. **Prévention** : DPF self-certification + DPA template + SCC fallback + Privacy Policy compliant + DPO si processing >250 employés ou large scale.
Partager :
J
Redige par
Jean Dupont
Consultant senior creation entreprise
Avocat d'affaires francais (barreau de Paris) + JD americain (Cornell Law School). Accompagne les entrepreneurs europeens dans leur expansion US depuis 2008. Specialiste LLC Delaware, Wyoming, New Mexico et structures holding internationales.
USINCO accompagne les non-residents dans la creation de leur LLC : EIN, Operating Agreement, BOI, agent enregistre inclus. 199 $ tout compris, delai 24-48h.
ChatGPT
Gemini
Claude
Perplexity
Grok