Hosted in the USA. Lawful under the GDPR.
Cal.com, Inc. is certified under the EU-U.S. Data Privacy Framework (DPF). Since the European Commission's adequacy decision of 10 July 2023, personal data may be sent to certified US companies under Article 45 GDPR (in Germany: DSGVO). No standard contractual clauses and no supplementary measures are needed. This page gives the legal basis, the open questions, and the sources to check all of it yourself.
Last reviewed on 6 November 2026. This page is information, not legal advice.
- Framework
- Status
- Covered data
- EU-U.S. Data Privacy Framework
- Active
- Non-HR
- UK Extension to the EU-U.S. DPF
- Active
- Non-HR
dataprivacyframework.gov/participant/2960, read 5 November 2026
On the same Data Privacy Framework List as Cal.com
- Microsoft
- Amazon
- Salesforce
- Adobe
- Zoom
- Atlassian
- Cloudflare
- Dropbox
- Oracle
- Cisco
- NVIDIA
Each company has an active entry for the EU-U.S. Data Privacy Framework on the list of the U.S. Department of Commerce, read on 5 November 2026. Names and marks belong to their owners and show no partnership with Cal.com.
Three facts your data protection officer can check in five minutes
No trust required. The statements on this page link to their sources: the decision, the public list, and the guidance of the European and German supervisory authorities.
01
There is an adequacy decision
With Implementing Decision (EU) 2023/1795 of 10 July 2023, the European Commission found that the USA ensures an adequate level of protection for personal data sent to companies on the Data Privacy Framework List. It is an adequacy decision under Article 45 GDPR, the same instrument that covers Switzerland, Japan and the United Kingdom, limited to certified companies.
02
Cal.com, Inc. is on the list
The U.S. Department of Commerce lists Cal.com, Inc., San Francisco, as an active participant in the EU-U.S. Data Privacy Framework and in its UK Extension, for non-HR data. The list is public: see Cal.com's entry.
03
No further transfer tool is needed
The European Data Protection Board states in its information note that transfers to listed companies may rest on the adequacy decision, without Article 46 tools such as standard contractual clauses and without supplementary measures. Germany's Datenschutzkonferenz (DSK) confirms in its Anwendungshinweise of 4 September 2023, its application guidance, that no further legitimation under Chapter V GDPR is required.
The two-step test for third-country transfers, applied to Cal.com
German supervisory authorities check a transfer in two steps: first the processing itself, then the transfer under Chapter V GDPR. Here is each step for Cal.com.
01
Step 1: a legal basis for the processing
Scheduling a meeting needs a legal basis under Article 6 GDPR, wherever the software runs. That choice is yours as the controller. Typical bases are a contract or the steps before one, Article 6(1)(b), and legitimate interests, Article 6(1)(f).
02
Step 1, continued: a processor agreement
For the booking data of your invitees, Cal.com acts as your processor. Our data processing agreement follows Article 28 GDPR. The subprocessors are named in our Trust Center, and we announce changes before they take effect.
03
Step 2: a transfer tool under Chapter V
Cal.com, Inc. is a US company and processes data in the United States. The transfer rests on Article 45 GDPR: the adequacy decision for the EU-U.S. Data Privacy Framework. Where the framework does not cover a transfer, the 2021 standard contractual clauses in our DPA apply (DPA section 12, SCC Schedule).
04
Your part: check the list
The decision covers listed companies only. The DSK asks every exporter to check that the importer is on the list today and that the entry covers the data. Cal.com's entry is active and covers non-HR data, which is the category for account and booking data.
Why this is not the Privacy Shield again
In Schrems II (C-311/18, 16 July 2020) the Court of Justice struck down the Privacy Shield for two reasons: US intelligence agencies could access data beyond what is necessary and proportionate, and people in Europe had no effective legal remedy. The Data Privacy Framework answers both, in US law.
01
Limits on intelligence access
Executive Order 14086 of 7 October 2022 binds the US intelligence agencies. Signals intelligence is allowed only for defined national security objectives, and only where it is necessary and proportionate. These are the terms the Court of Justice used.
02
A court for people in Europe
The order created the Data Protection Review Court. Anyone in the EU can lodge a complaint with their own data protection authority. It reaches the US authorities through the European Data Protection Board. Nobody has to prove that their data was in fact collected.
03
Binding rules for certified companies
A certified company commits to the DPF Principles: notice, choice, accountability for onward transfer, security, data integrity and purpose limitation, access, and recourse, enforcement and liability. Certification is voluntary. Compliance after certification is compulsory, enforceable by the U.S. Federal Trade Commission, and renewed every year.
04
Reviewed, and upheld in court
The Commission reviewed the framework and reported on 9 October 2024 that the US had put the necessary structures in place. On 3 September 2025 the General Court of the EU dismissed the action for annulment in Latombe v Commission (T-553/23). The case is now before the Court of Justice (C-703/25 P), which has not yet ruled.
Cal.com with the DPF, or Cal.eu hosted in Europe
Both are lawful under the GDPR, and both are the same product. Cal.com sends data to the USA on the basis of the adequacy decision. Cal.eu keeps it in the European Union, for organizations whose contracts, sector rules or internal policy demand data residency. Cal.eu answers a different question: where the data sits.
| Feature | Cal.com with the DPF | Cal.eu, hosted in Europe |
|---|---|---|
| Data | ||
| Where data is stored and processed | United States | European Union |
| Basis for sending data to the USA | Article 45 GDPR: adequacy decision for the EU-U.S. Data Privacy Framework | None needed: the data stays in the EU |
| Second transfer tool | Standard contractual clauses in the DPA | Not needed for hosting in the EU |
| Compliance | ||
| GDPR, SOC 2 Type II, ISO 27001 | ||
| Product | The full Cal.com app | The same app |
| Availability | ||
| Plans | Every plan, including the free one | Enterprise |
| Individuals and Teams accounts | ||
| Made for | Individuals, teams and companies that accept transfers under an adequacy decision | Organizations that must keep data in the EU |
What you do as the controller
Four steps, in line with the Anwendungshinweise of the German supervisory authorities.
01
Check the entry and keep proof
Open Cal.com, Inc.'s entry on the Data Privacy Framework List. Note the status, the covered data and the date. That note is your proof under Article 5(2) GDPR, the accountability principle.
02
Conclude the processor agreement
Conclude our DPA under Article 28 GDPR. It already includes the standard contractual clauses as the second transfer tool.
03
Tell the people you schedule with
Name the transfer in your privacy notice: a recipient in the USA and the adequacy decision, as Article 13(1)(f) GDPR asks. Add both to your record of processing activities under Article 30.
04
Look again once a year
A certification runs for one year and is then renewed. The DSK reminds controllers to check that the entry and the adequacy decision are still in force. One calendar entry a year covers it.
The hard questions about US hosting
What a data protection officer, a works council or a legal team will ask. Answered without the marketing.
Ask a questionBoth fell for the same reasons: US law gave the intelligence agencies broad access, and it gave people in Europe no court. Executive Order 14086 changed US law on both points, and the Data Protection Review Court exists.
The General Court of the EU examined exactly these points and upheld the adequacy decision on 3 September 2025. The case is now before the Court of Justice (C-703/25 P), which has not yet ruled. Until a court rules otherwise, the decision is binding EU law in every member state.
Both laws exist, and we will not pretend otherwise. Collection under FISA Section 702 is now bound by Executive Order 14086: tied to defined objectives, necessary, proportionate, and open to review by the Data Protection Review Court. The Commission assessed this in its adequacy decision.
The CLOUD Act is about criminal investigations. It works through legal process for specific accounts, such as a warrant or a court order, not through bulk collection. It applies to every provider under US jurisdiction, wherever the servers are. Like any company, Cal.com can be required to disclose data in response to lawful requests by public authorities.
Then transfers need another tool, as the DSK notes in its Anwendungshinweise. Ours is already in place: the DPA includes the 2021 standard contractual clauses, and they apply to every transfer the framework does not cover (DPA section 12).
The safeguards of Executive Order 14086 are US law. They apply to all data sent to the USA, whatever the transfer tool, as the European Data Protection Board points out. Organizations that want no transfer question at all can talk to us about Cal.eu.
No. A TIA and supplementary measures belong to transfers that rest on Article 46 tools such as standard contractual clauses. For transfers to listed companies, the information note of the European Data Protection Board is explicit: no Article 46 tool, and no supplementary measures.
Not for the transfer. Article 45 GDPR is the basis for it, so the consent exception in Article 49 does not come into play. The booking itself needs a legal basis under Article 6, as it would with any scheduling tool in any country.
Under the framework, HR data means personal data about a certified company's own staff, collected in the employment relationship. The DSK notes that this is how the US side reads the term. Cal.com processes account and booking data as a service for its customers, which is non-HR data.
German authorities ask exporters to look closely at employee data that is sent in an employment context. If you take the stricter view, the standard contractual clauses in our DPA cover that transfer.
The United Kingdom: yes. Cal.com, Inc. is certified under the UK Extension to the EU-U.S. Data Privacy Framework, in force since 12 October 2023. Switzerland: Cal.com is not certified under the Swiss-U.S. Data Privacy Framework. Transfers from Switzerland rest on the standard contractual clauses with the Swiss amendments, in our SCC Schedule.
Write to privacy@cal.com first. We answer complaints about the framework within 45 days. If that does not settle it, Cal.com has committed to cooperate with the panel of the EU data protection authorities and to follow its advice. This is free of charge for the person who complains.
A complaint about access by US intelligence agencies goes to your national data protection authority, which passes it on through the European Data Protection Board. Our privacy policy has the details.
No. It is our reading of the public sources listed below. The date of the last review is at the top of this page. Your data protection officer decides for your organization, and we are glad to answer their questions at privacy@cal.com.
Read the originals
Everything above comes from these documents. None of them is ours.
- Commission Implementing Decision (EU) 2023/1795 of 10 July 2023: the adequacy decision for the EU-U.S. Data Privacy Framework.
- Data Privacy Framework List, U.S. Department of Commerce: the public register of certified companies, with Cal.com, Inc.
- Data Privacy Framework Program Overview, U.S. Department of Commerce: how certification works and what it binds a company to.
- Information note on data transfers to the United States, European Data Protection Board: no Article 46 tool and no supplementary measures for listed companies.
- Anwendungshinweise zum EU-US Data Privacy Framework, Datenschutzkonferenz (DSK), 4 September 2023: the guidance of the German supervisory authorities, in German.
- Executive Order 14086 of 7 October 2022: the limits on US signals intelligence and the Data Protection Review Court.
- Judgment in Schrems II, C-311/18, Court of Justice, 16 July 2020: why the Privacy Shield fell.
- Judgment in Latombe v Commission, T-553/23, General Court, 3 September 2025: the action against the adequacy decision, dismissed.
- EU-US data transfers, European Commission: the periodic reviews of the framework.
Scheduling with a legal basis you can cite
Cal.com for everyone, under the EU-U.S. Data Privacy Framework. Cal.eu for organizations that keep their data in the European Union.
Get startedSee Cal.eu