“We have SCCs and a DPA”
Contracts and standard clauses are in place
Your contract binds your supplier. It does not bind an American court.
Standard contractual clauses and a data processing agreement set out what a supplier is allowed to do with a customer's data. They are agreements between two private companies. They do not limit what a court can order one of those companies to do, and an order does not stop being valid because the company signed a contract promising otherwise. This is why the Court of Justice of the European Union struck down the previous EU-US data arrangement in 2020 rather than simply asking for stronger contracts: a contract cannot bind a government that never signed it.
18 U.S.C. §2713 · checked 2026-09-04 · Commission Implementing Decision (EU) 2023/1795 · checked 2026-09-04
What to ask instead
Which part of the agreement covers an order from a court outside Europe?
A data agreement covers what your supplier chooses to do. The question is what your supplier can be forced to do, and most agreements never mention it at all.
If the answer is a European company you can name, that settles it.
Which of these is true of your company?
The test asks which tools you actually use, then answers this question for each of them from the same documents — and shows what your own domain says. A few minutes, no account, nothing kept.
Run it on your own company