UK & Schweiz: GDPR Assessment & Vendor List

Both countries have adequacy decisions from the EU Commission. Data transfers are permitted without standard contractual clauses. The risk is significantly lower than with US providers. However, the decisions are subject to political review; a new UK data protection law or a revised Swiss DSG could change this status in future. In procurement procedures, UK/CH is currently usually rated the same as EU.

Directly, no: the CLOUD Act only applies to US companies. However, the UK has its own Investigatory Powers Act (2016), which provides similar access rights for British authorities. For highly sensitive processing (public authorities, critical infrastructure), many DPOs therefore additionally check whether the UK provider uses EU data centres.

Yes. The revised Data Protection Act (revDSG) has been in force since September 2023 and is largely equivalent to GDPR. The EU renewed its adequacy decision for Switzerland in 2024. Swiss providers therefore remain a low-risk option for DACH customers.

We check the registered seat and parent company (commercial register, legal notice, privacy policy), the contractual partner for EU customers, the hosting region, and the subprocessor list. For multi-level structures (EU contractual partner + US parent), we label the primary jurisdiction and additionally flag ‘third-country transfer check required’.