OCR Documents Containing EU Personal Data: Transfer Rules
By Schema LawPublished Updated
Before you OCR documents containing EU personal data in a US service, settle three things: whether the GDPR applies to the processing, whether the service will act as a processor under a written contract, and which transfer tool covers sending the data outside the EU. The EU client's own instructions decide a good part of the answer.
This post quotes the General Data Protection Regulation and European Commission pages as opened in October 2026. It explains how to handle the documents and is not legal advice. It covers the EU regulation only, so check national law and the rules of any other country the documents came from.
When does the GDPR reach a US law firm's client documents?
The GDPR reaches a US law firm's client documents in two ways. The regulation can apply to the processing directly under its territorial scope article. Or it applies to the EU client, and the client passes its obligations to the firm by contract and instruction. The second route is the one to check first in a client file.
Direct application under Article 3
Article 3 of the General Data Protection Regulation sets the territorial scope. Paragraph 1 says the regulation "applies to the processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union, regardless of whether the processing takes place in the Union or not." Paragraph 2 extends it to a controller or processor "not established in the Union" when the processing relates to:
(a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or
(b) the monitoring of their behaviour as far as their behaviour takes place within the Union.
The European Data Protection Board's Guidelines 05/2021 on the interplay between Article 3 and Chapter V add that "whether or not the GDPR applies must always be assessed in relation to a certain processing operation rather than with regard to a specific entity (e.g. a company)." So the question is asked about this file and this task, and a firm can be inside the regulation for one matter and outside it for another.
Application through the client
Personal data is defined in Article 4(1) as "any information relating to an identified or identifiable natural person". A box of scanned employment contracts, customer complaints or patient letters from a client's German or French affiliate is full of it. If that affiliate is subject to the regulation, it has duties about who processes the data and where the data goes. It meets them by binding whoever it hands the data to.
| Situation | What to check |
|---|---|
| The firm has an office in an EU member state that works on the matter | Article 3(1), with local counsel |
| The firm has no EU office and the client is an EU company or affiliate | The engagement terms, any data processing or transfer agreement the client asked the firm to sign, and outside counsel guidelines |
| The client is a US company and the documents came from its EU subsidiary | How the data moved from the subsidiary to the parent, and what conditions came with it |
| The documents came from an opposing party in discovery | Any protective order or agreement about the data, and whether the producing party flagged EU data |
Whichever row fits, the practical point is the same. Someone with authority on the client side has to tell you what they have agreed to and what they permit, before a third service sees the pages.
Is an OCR service a processor of the EU personal data in a scan?
An OCR service that converts scans on your behalf performs "processing" as the GDPR defines it, and a party that processes personal data on behalf of a controller is a "processor". Where the regulation applies, Article 28 requires a written contract with specific contents between the controller and the processor.
The definitions are in Article 4:
- Processing is "any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means", and the listed examples include "collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval". Reading a scan into text and storing the result is within those words.
- Controller is the person or body which "alone or jointly with others, determines the purposes and means of the processing of personal data".
- Processor is a person or body "which processes personal data on behalf of the controller".
Who is the controller here?
The regulation's test is who determines the purposes and means. In a client file, the candidates are the client, the firm or both, and the answer is not the same for every engagement. Ask the client how it has characterized the firm's role, and look at what you signed. The role matters because it decides who must hold the Article 28 contract with the OCR service and who must authorize it.
What Article 28 requires
Article 28(1) says a controller "shall use only processors providing sufficient guarantees to implement appropriate technical and organisational measures". Article 28(2) says "The processor shall not engage another processor without prior specific or general written authorisation of the controller." If your firm is itself the client's processor, that sentence means the client must authorize the OCR service before you use it.
Article 28(3) requires "a contract or other legal act" that binds the processor and sets out "the subject-matter and duration of the processing, the nature and purpose of the processing, the type of personal data and categories of data subjects". It then lists what the contract must stipulate. For a conversion service, the list reads like this:
| Article 28(3) point | The processor must | What that looks like for an OCR service |
|---|---|---|
| (a) | Process "only on documented instructions from the controller, including with regard to transfers of personal data to a third country" | No use of uploads beyond conversion; stated processing locations |
| (b) | Ensure persons authorised to process the data "have committed themselves to confidentiality" | Staff confidentiality obligations |
| (c) | Take the security measures Article 32 requires | A description of security measures |
| (d) | Respect the conditions for engaging another processor | A subprocessor list and a change procedure |
| (e), (f) | Assist the controller with data subject requests and with its security and breach obligations | A contact and a process |
| (g) | Delete or return all the personal data "after the end of the provision of services" | Deletion on request and at termination |
| (h) | Make available "all information necessary to demonstrate compliance" and allow audits | Audit or information rights |
A general explanation of these terms in a vendor's standard paperwork is in the post on which clauses decide what happens to uploaded client documents. Ask any OCR vendor, Schema Law included, whether it offers a data processing agreement and read it against the table. This post makes no statement about any vendor's position under the regulation.
What makes uploading EU personal data to a US service a restricted transfer?
"Restricted transfer" is a practitioner's label. The GDPR itself speaks of a "transfer of personal data ... to a third country" and restricts it in Chapter V. An upload to a US service is such a transfer when a party subject to the regulation makes the data available to a recipient outside the EU.
Article 44 states the general principle: a transfer to a third country "shall take place only if, subject to the other provisions of this Regulation, the conditions laid down in this Chapter are complied with by the controller and processor, including for onward transfers of personal data from the third country or an international organisation to another third country".
The regulation does not define "transfer". The European Data Protection Board says so in the executive summary of its Guidelines 05/2021 and gives three cumulative criteria:
1) A controller or a processor (“exporter”) is subject to the GDPR for the given processing.
2) The exporter discloses by transmission or otherwise makes personal data, subject to this processing, available to another controller, joint controller or processor (“importer”).
3) The importer is in a third country, irrespective of whether or not this importer is subject to the GDPR for the given processing in accordance with Article 3, or is an international organisation.
The guidelines continue: "If the three criteria as identified by the EDPB are met, there is a transfer and Chapter V of the GDPR is applicable."
Applying the criteria to a file
A scan can cross a border more than once on its way to an OCR service:
- EU client to US law firm. If the client is subject to the regulation and sends personal data to the firm in the United States, the criteria point to a transfer. The client is the exporter and should already have a transfer tool in place with the firm. Ask which one.
- US law firm to OCR service. Article 44 extends the chapter's conditions to "onward transfers" from the third country. What the firm may do next depends on the terms it accepted from the client.
- OCR service to its own providers. The service may pass pages to other companies, in the same country or another one.
The third step is why the location question needs a precise answer. The post on OCR data residency explains how to find out where a vendor processes and stores files. An OCR service with servers in the EU does not by itself end the analysis, because the client's transfer to the firm in the United States is still part of the chain.
Standard contractual clauses and the Data Privacy Framework for an OCR upload
Standard contractual clauses and the EU-US Data Privacy Framework are two of the transfer tools the GDPR recognizes. The framework rests on an adequacy decision under Article 45 and covers participating US organisations. The clauses are a contract safeguard under Article 46. Find out which one your client used with your firm, and which one the OCR vendor offers.
Adequacy and the Data Privacy Framework
Article 45(1) allows a transfer "where the Commission has decided that the third country, a territory or one or more specified sectors within that third country, or the international organisation in question ensures an adequate level of protection. Such a transfer shall not require any specific authorisation."
The European Commission's page on adequacy decisions lists the United States with a qualifier: "The United States (commercial organisations participating in the EU-US Data Privacy Framework)". Its page on EU-US data transfers says "personal data can flow freely from the EU to companies in the United States that participate in the Data Privacy Framework".
The qualifier is the point. The decision covers participants, not the whole country. For an OCR upload, that means asking whether the vendor participates, whether its participation is current, and whether it covers the kind of data in your file. Ask the same about your own firm if the client is relying on the framework to send documents to you.
Standard contractual clauses
Where no adequacy decision applies, Article 46(1) allows a transfer "only if the controller or processor has provided appropriate safeguards, and on condition that enforceable data subject rights and effective legal remedies for data subjects are available." Article 46(2)(c) lists "standard data protection clauses adopted by the Commission" among the safeguards that need no specific authorisation from a supervisory authority.
The Commission's page on standard contractual clauses describes them as model contract clauses that have been "pre-approved" by the European Commission, and says the modernised clauses issued on 4 June 2021 are for transfers "from controllers or processors in the EU/EEA (or otherwise subject to the GDPR) to controllers or processors established outside the EU/EEA (and not subject to the GDPR)".
How to check which tool a vendor uses
| Where to look | What you are looking for |
|---|---|
| The vendor's data processing agreement | A section on international transfers that names the clauses or the framework |
| The vendor's privacy policy | A statement of participation in the Data Privacy Framework |
| The subprocessor list | The country of each company that receives content, and the tool used for each |
| A written question to the vendor | "Which transfer mechanism applies to personal data from the EU that we upload, and to each onward transfer to your subprocessors?" |
Article 49 also lists derogations for specific situations, one of which is that "the transfer is necessary for the establishment, exercise or defence of legal claims". Whether a derogation fits a routine conversion of a document set is a question for someone qualified in EU data protection law. Do not assume it from the wording.
Special category data in scanned EU employment and medical files
Special category data is the stricter class in Article 9 of the GDPR, and scanned employment and medical files are the places to look for it. Processing of the listed kinds of data is prohibited unless one of the conditions in Article 9(2) applies. Identify these pages before conversion and get the client's instruction on them.
Article 9(1) reads:
Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation shall be prohibited.
Article 9(2) lists the conditions under which paragraph 1 "shall not apply". They include explicit consent of the data subject under point (a), employment and social security law obligations under point (b), and, under point (f), that "processing is necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity". Which condition the client relies on is the client's determination.
Where it shows up in a scanned file
| Document | Special category data it may reveal |
|---|---|
| Sick notes, fitness-for-work certificates, occupational health reports | Health |
| Payroll records showing union dues deductions | Trade union membership |
| Personnel forms recording a religious affiliation | Religious beliefs |
| Works council and collective bargaining correspondence | Trade union membership |
| Accommodation requests and disability records | Health |
| Medical charts, lab results, insurance claim files | Health, and possibly genetic data |
Handling these pages
- Separate them at intake and count them.
- Ask the client whether they may go to an outside service at all, and on what condition.
- Upload the minimum. A dispute about a dismissal date may not need the employee's medical certificates converted.
- Remember that an export concentrates the data. A spreadsheet of 400 employees with a sick-leave column is far easier to misuse than 400 scanned pages.
- Check converted health terms and dates against the image, because a misread diagnosis or date in a legal file causes its own harm.
A pre-upload routine for documents from an EU client or affiliate
A pre-upload routine for documents from an EU client or affiliate is a short series of questions answered in writing before the first page goes to an OCR service: whose data, under what terms, to which vendor, in which country, under which transfer tool. Keep the answers in the matter file.
- Identify the source. Which entity supplied the documents, and is it established in the EU?
- Find the terms that came with the data. Look for a data processing agreement, standard contractual clauses or data protection provisions in the engagement letter or outside counsel guidelines.
- Ask the client who its data protection contact is. Put the conversion plan to that person, not only to the business contact.
- Sort the file. Separate pages with special category data. Set aside pages with no personal data, which need none of this.
- Get the vendor's paperwork. The data processing agreement, the transfer mechanism, the subprocessor list and the processing locations.
- Compare the vendor's terms with the Article 28(3) points and with whatever the client's terms require of the firm's own service providers.
- Get the client's authorisation in writing for the named service. The post on client consent to use AI tools covers what to tell a client about a tool before asking.
- Upload the minimum, export what the work needs, and delete the service copy when the task is finished. Record the dates.
A worked example
A New York firm represents a fictional Dutch logistics company, Veldkamp Transport B.V., in a US commercial arbitration. The client sends 1,200 scanned pages from its Rotterdam office: contracts, delivery records, and personnel files for six drivers.
The associate finds that the engagement letter attaches standard contractual clauses between the client and the firm and requires written approval of any service provider that will receive personal data. She splits the set. The contracts and delivery records name business contacts and drivers. The personnel files contain medical certificates.
She asks the OCR vendor for its data processing agreement and its transfer mechanism, and sends both to the client's privacy officer with a two-line description of the task. The privacy officer approves conversion of the contracts and delivery records and declines for the personnel files. The firm converts 1,050 pages, keeps the 150 personnel pages as images on its own system, and files the approval email with the matter.
Keep a records of processing note beside that email. List the data subject groups on the pages you converted, the country the files came from, and the transfer tool the privacy officer accepted. Data minimization is why the medical certificates stayed on the firm's own system. A cross-border data transfer is easier to reconstruct later when the note names the date and the page count.
What this routine does not settle
It does not decide whether the regulation applies, which role the firm holds or which Article 9 condition fits. Those belong to the client and its EU advisers. The routine makes sure that someone asked before the upload. For what Schema Law's site commits to on uploads, read the security section of the homepage as written and put any question it does not answer to the vendor in writing.