EU / European Union / revised 28 Oct 2026
Schrems II Supplementary Measures for LLM Inference
Schrems II invalidated the Privacy Shield and held that standard contractual clauses only work if the exporter verifies, case by case, that the destination's law does not undermine them. The EDPB's Recommendations 01/2020 then showed that the strongest technical measure, encryption with keys held in the EU, stops working whenever the importer needs the data in clear text. Model inference is exactly that case.
- Citation
- CJEU Case C-311/18 (Schrems II); EDPB Recommendations 01/2020 on supplementary measures, version 2.0
- Regulator
- European Data Protection Board and national supervisory authorities
- In force
- 16 July 2020
- Maximum penalty
- EUR 20 million or 4% of worldwide annual turnover under GDPR Article 83(5)(c)
What the Court decided
In Case C-311/18, judgment of 16 July 2020, the CJEU annulled the EU-US Privacy Shield adequacy decision because US surveillance law, notably Section 702 FISA and Executive Order 12333, was not limited to what is strictly necessary and offered EU data subjects no effective remedy. The Court upheld the SCC decision as a mechanism but placed a duty on exporters to suspend transfers where the clauses cannot be complied with in practice.
The six steps of EDPB Recommendations 01/2020
The final version 2.0, adopted on 18 June 2021, asks exporters to know their transfers, identify the transfer tool, assess whether the third country's law or practice impinges on the tool's effectiveness, adopt supplementary measures where it does, take any formal procedural steps, and re-evaluate at appropriate intervals.
- Contractual measures (transparency clauses, warrant canaries, challenge obligations) cannot bind public authorities on their own.
- Organisational measures (access policies, data minimisation, documented handling of government requests) support but do not replace technical ones.
- Technical measures must make the data unintelligible to the third-country authority to be effective on their own.
Use cases 6 and 7: why inference is hard
Annex 2 of the Recommendations describes scenarios where effective measures exist, such as storage of data encrypted with keys held only by the exporter (use case 1) and transfer of properly pseudonymised data (use case 2). It also describes scenarios where the EDPB found no effective measure: use case 6, transfer to a cloud provider or other processor that requires access to data in the clear, and use case 7, remote access for business purposes. A language model must read the prompt to answer it, so an LLM endpoint in a problematic jurisdiction sits squarely in use case 6.
- 01
Pseudonymise before egress
Following use case 2, replace names, account numbers and national IDs with stable tokens and keep the mapping table in the EU. The model reasons over tokens, and the response is re-identified in-region. - 02
Accept the limits of pseudonymisation
Free-text prompts carry indirect identifiers such as job titles, rare diagnoses and locations. Masking reduces exposure but rarely meets the EDPB's bar that the data cannot be attributed even with additional information, so pair it with in-region routing for sensitive classes. - 03
Prefer processing where no transfer arises
The only measure that fully removes the use case 6 problem is not transferring: route the inference to an EEA or adequate endpoint operated by an entity within EU jurisdiction. - 04
Keep the TIA tied to the route
A transfer impact assessment is specific to a destination, importer and data category. Store the TIA reference on the route definition so a change of region or provider forces a new assessment. - 05
Evidence that measures ran
Record, per request, whether masking was applied and which entity classes were tokenised. That is the evidence that a supplementary measure was effective in practice, not just in a policy document.
| # | Rule | Legal rationale |
|---|---|---|
| 01 | When a route depends on Article 46 SCCs, require the pii-guardrail stage to run in mask mode before egress. | Recommendations 01/2020 use case 2: pseudonymisation with the key held in the EU is a recognised technical measure. |
| 02 | Block special category and criminal-offence data from any route classified as use case 6. | Where the importer needs clear text in a country with problematic access laws, the EDPB found no effective supplementary measure. |
| 03 | Deny routes whose TIA reference is missing or older than the configured review interval. | Step 6 of the Recommendations requires re-evaluation; a stale assessment is not a current safeguard. |
| 04 | Keep the pseudonymisation vault and its keys in the origin jurisdiction and never replicate them to the destination region. | A key held by the importer would make the tokens reversible by the very authority the measure is meant to exclude. |
eu-scc-supplementary
The rules above, written as Open Policy Agent Rego (v1 syntax). The gateway evaluates the pack in-process in every regional data plane before forwarding a request; YTT Secunet measures median evaluation under 3 ms in production.
Packs are versioned and signed. The version that decided each request is named in the residency receipt, so an auditor can match the decision to this exact text.
How the policy engine workspackage yttsecunet.policies.eu_scc_supplementary
import rego.v1
max_tia_age_days := 365
relies_on_sccs if input.endpoint.transfer_tool == "scc-2021-914"
tia_age_days := (time.now_ns() - time.parse_rfc3339_ns(input.endpoint.tia.reviewed_at)) / (24 * 60 * 60 * 1000000000)
deny contains "scc route requires masking before egress" if {
relies_on_sccs
input.guardrail.mode != "mask"
}
deny contains "special category data on clear-text route" if {
relies_on_sccs
some cls in input.guardrail.detected
cls in {"health", "biometric", "genetic", "criminal"}
}
deny contains "transfer impact assessment is stale" if {
relies_on_sccs
tia_age_days > max_tia_age_days
}
deny contains "pseudonymisation vault outside origin" if {
input.vault.jurisdiction != input.tenant.jurisdiction
}Each item is verifiable against configuration, signed receipts or contract records. Tick through it with your DPO.
Is TLS or encryption at rest a supplementary measure for inference?
Not on its own. TLS protects data in transit and encryption at rest protects storage, but the model provider decrypts the prompt to process it. The EDPB found that where the importer needs clear text, encryption does not prevent access by the destination's authorities.
Did the Data Privacy Framework make Schrems II irrelevant?
Not entirely. The 10 July 2023 adequacy decision covers certified US organisations. Transfers to non-certified importers, and to other third countries, still rely on SCCs with the Schrems II assessment.
Can confidential computing solve use case 6?
Attested enclaves can narrow who can read data in memory, but the EDPB has not recognised them as an effective measure for this scenario, and the operator often still controls the platform. Treat them as risk reduction in the TIA, not as a substitute for in-region processing.
Sovereign route ready
Stop risking 4% global turnover GDPR fines on AI inference.
Deploy sovereign, cryptographically proven AI routing in 15 minutes.