US sales tools and GDPR in 2026: transfers

This is an editorial walkthrough of a legal position that is still moving, not legal advice, written in September 2026 from sources at IMY, the European Commission and the EU courts; if anything has moved since, IMY's news page is the first place it will show. Two things are settled: the definition of a transfer, and the three routes that make one lawful. What is moving is the basis almost every American tool rests on today: the European Commission's adequacy decision for the Data Privacy Framework of 10 July 2023, upheld by the EU General Court on 3 September 2025, and the very decision IMY asked organisations on 3 July 2026 to be ready to do without.

Where the law stood in September 2026

On 10 July 2023 the European Commission adopted its adequacy decision for the EU-US Data Privacy Framework. Under it, personal data can flow freely from the EU to US companies that take part in the framework, which they do by self-certifying and appearing on the framework's website. The French parliamentarian Philippe Latombe challenged the framework in court, and on 3 September 2025 the EU General Court dismissed his action for annulment, confirming that at the date of the decision the United States ensured an adequate level of protection. The judgment was reportedly appealed to the Court of Justice in October 2025, and when this was written in September 2026 the appeal had not been decided. As long as the adequacy decision stands, a vendor on the list can receive your customer data without any further safeguards; if the decision is revoked or amended, plan B below applies.

Why the question is open for a third time

The Court of Justice has struck down two earlier US adequacy decisions: Safe Harbor in 2015 and Privacy Shield in the Schrems II judgment of 16 July 2020, which at the same time held that the standard contractual clauses remained valid. What has raised the question a third time is American domestic politics. On 3 July 2026 IMY described how the US Supreme Court, in Trump v. Slaughter, had found that a president may remove a member of the Federal Trade Commission without cause, and how members had already been removed from both the FTC and the Privacy and Civil Liberties Oversight Board, two bodies that IMY considers important for the framework to work. The question is whether they can still be regarded as independent, and whether that affects the validity of the adequacy decision from here on. IMY's director general Eric Leijonram put it plainly: there is still a valid adequacy decision, but organisations should stay informed and be prepared, and may for instance need to retrieve their data from vendors. The Commission can revoke, amend or repeal its decision, and the EDPB is analysing the consequences together with IMY.

Three routes that make a transfer lawful

IMY's guidance on transfers to third countries, updated in August 2025, is clear about what counts: a transfer is personal data being sent or otherwise made available to a recipient outside the EU and EEA, including when you engage a processor there or give someone outside the EU read access. If your American CRM vendor's support team can open your customer database, that is a transfer, even when the server sits in Ireland. The first route is an adequacy decision, such as the Data Privacy Framework. The second is appropriate safeguards, in practice the Commission's standard contractual clauses of 4 June 2021 or binding corporate rules, backed by the assessment of the recipient country's laws that the EDPB sets out in its Recommendations 01/2020. The third is the exceptions for specific situations and occasional transfers, which will rarely carry a sales tool you use every day.

Take stock of the sales stack

Make the list before someone else asks you for it. For every tool that holds customer data: where is the data stored, is the vendor on the DPF list, does the processing agreement include standard contractual clauses as a fallback, which sub-processors sit in the United States, and how would you export and delete everything if you had to switch.

• The CRM: the entire customer database, often with meeting notes attached. The biggest fallout if the route closes.
• Dialer and telephony: call logs and sometimes recordings, which are personal data about the customer and the rep alike.
• Enrichment and prospect lists: data on people you have never spoken to, resting on the weakest legal basis.
• Email and sequencing tools: addresses, opens, replies. Usually synced with the CRM in both directions.
• Meeting assistants and transcription: entire conversations as text; we have a separate checklist for those.
• AI tools for practice and writing: ask whether real customer data needs to go in at all.

Plan B in four steps

Being prepared does not mean switching tools pre-emptively. It means knowing which basis every transfer rests on, and what you will do the day that basis changes. Step one: check the DPF list for every vendor and note the result in your record of processing activities. Step two: make sure the processing agreement contains the standard contractual clauses as a fallback basis, so a revoked adequacy decision does not leave you without a lawful route overnight; certified vendors often include the clauses already, but they have to be in your contract. Step three: test export and deletion for real, timing how long it takes to get the entire customer database out in a usable format and checking how the vendor confirms the copy is gone. Step four: ask about EU hosting. Several large vendors offer storage inside the EU, but what settles the matter is the sub-processors and support access, not where the server stands, so read the trust page and the contract rather than taking a headline on faith.

What you do not need to do

You do not need to drop your American vendors, and you do not need to sign new contracts this week. In September 2026 the adequacy decision applied, the General Court's judgment stood, and IMY's message was to stay informed and be prepared; check IMY's news page before acting on this article. What you want to avoid is what made Schrems II so expensive for so many: finding out after the fact that nobody knew which tools held what, or how the data would get home. A record and a tested export flow are the whole difference between a news item and a crisis.

Practice needs no customer data

One way to shorten the list is to keep real customer data out of tools that do not need it. In Salesprep you talk to fictional AI customers and describe your own counterparts without any personal data; the raw audio from practice calls is deleted right after scoring, and you can delete transcripts and scores whenever you like. The Cold call module is included in every plan with three free calls, and all six modules are on Team Pro.