On this page
Start with the training request, not system-wide access
Consider a French facilities company whose American operator asks for all European service tickets. They contain customer contacts and employee names. Ask what the training must teach and whether examples without identifying information could meet that purpose.
If identifiable records are still needed, decide which categories to share, who will receive them and who else can access them. Set the purpose, access limits, retention and return or deletion arrangements. Using fewer records may change the proposal, but does not by itself establish anonymisation or make the transfer lawful.
Check the company that will actually receive the records
CNIL describes the EU–U.S. Data Privacy Framework (DPF) as covering participating U.S. organisations. Check active certification and its scope for the receiving legal entity. A group logo or a related company’s certification is insufficient: the operator may be a different company from the named subsidiary.
Check the covered data as well, including the relevant treatment of employee-related human-resources data. If the recipient is not actively covered, assess another applicable route under the GDPR’s international-transfer rules, Chapter V, before the transfer.
A covered processor still needs the processing agreement
Work out whether the American company is processing the records for you or acting in another role. If you are the controller transferring data to a U.S. processor, the required Article 28 processing agreement is needed regardless of DPF certification. Certification addresses the transfer route; it does not replace that contract or the other GDPR duties.
For the ticket request, this means checking the actual operator and its role before granting access—not treating a provider’s certification badge as the answer to the whole proposal.
Scope
- The detailed checks come from the EDPB’s January 2026 version 2 FAQ. No particular recipient’s certification, role or transfer is approved here; lawful processing, security, onward access and other GDPR duties still need assessment.
Next step
Decide which training records are necessary, then confirm the actual recipient’s transfer route and any required Article 28 agreement before access.
Terms used here
- Data Privacy Framework (DPF)
- The EU-U.S. transfer framework covering participating American organisations under its conditions.
- Controller and processor
- A controller decides why and how personal data is processed. A processor processes it for a controller; that relationship can require an Article 28 agreement.
Sources & review notes
CNIL, France
Passage, dates and research notes
official-guidance · Questions 4–5: certified recipients and remaining GDPR obligations
Avant de procéder au transfert, les organismes doivent s’assurer que l’organisme destinataire figure sur cette liste
French regulator overview read alongside the newer EDPB version 2 FAQ; older HR explanations must not override newer guidance.
European Data Protection Board
Passage, dates and research notes
official-guidance · Questions 3, 3.1 and 3.3; pp. 4–6
all other requirements in the GDPR and any other national data protection law remain applicable.
PDF states adopted 15 January 2026; webpage publication is 23 January 2026. Full PDF read. Distinguish corporate subsidiaries, certification scope, HR-data coverage and Article 28 processor contracts.
Keep this reading in your learning library.
Progress privacy
Off by default. Without remembering, changes last on this page. If enabled, only public content identifiers and self-reported progress are stored in this browser profile. Anyone using the same profile could see them. No plan inputs or contact details are included. Reset or export in learning settings.
This is a reading aid, not evidence of disclosure delivery, expertise or legal approval.