united-states gdpr international european-union
Does my own company also need to be EU-US Privacy Shield certified if we use AWS to store data of European customers?
<p>We're based in United States. We understand that any sub-processor that we use should be EU-US Privacy Shield certified and GDPR compliant.
So, we can use AWS and Google Cloud. Both of them are EU-US Privacy Shield certified.</p>

<p>But does my own company also needs to be EU-US Privacy Shield certified also?</p>

<p>Can we declare ourselves GDPR compliant after doing the due diligence but not have to certify ourselves in the EU-US Privacy Shield?</p>

<p>Based on the information provided in the question and comments, you are a Software as a Service provider established outside the European Union, providing services to European Union clients who will use your SaaS solution to process personal data that is subject to the jurisdiction of the GDPR. If you market your service to <em>consumers</em> in the Union, you are also caught by the GDPR's extraterritorial provisions.</p>

<p>As such, those controllers established in the Union must comply with the requirements of <a href="https://gdpr-info.eu/art-28-gdpr/" rel="nofollow noreferrer">Article 28</a> in respect of processors they engage, including yourselves. When they transfer personal data to you, it is transferred to a <a href="https://uk.practicallaw.thomsonreuters.com/w-014-8210" rel="nofollow noreferrer">third country</a> and subject to <a href="https://gdpr-info.eu/chapter-5/" rel="nofollow noreferrer">Chapter V</a> of the GDPR. The <a href="https://www.privacyshield.gov/" rel="nofollow noreferrer">EU-U.S. Privacy Shield Framework</a> is subject to an adequacy decision recognised pursuant to <a href="https://gdpr-info.eu/art-45-gdpr/" rel="nofollow noreferrer">Art. 45</a>(9) GDPR.</p>

<p>The above would suggest that as the contracting party to whom the controller transfers personal data, irrespective of your use of sub-processors, you must self-certify under Privacy Shield. You will also need to provide an executable (signable) data protection addendum to your terms for EU (and EEA, UK, etc.) clients, and you should be prepared to disclose the identity of your sub-processors. Bear in mind Art. 28(4) that imposes the same terms on sub-processors as in the top-level processor contract.</p>
