Dropbox Watchdog

Search issues

Search the Dropbox Watchdog archive

All issues

Schrems II: why EU users' files on Dropbox sit under a legal cloud

July 2020

MediumStatus: Ongoing EU/EEA organizations and users affectedProduct: Core sync / complianceYear: 2020

The EU's 2020 Schrems II ruling struck down the Privacy Shield framework over US surveillance, leaving EU organizations that store data with US providers like Dropbox needing extra safeguards — and unable to fully escape US legal reach.

What happened

In July 2020 the Court of Justice of the European Union, in the 'Schrems II' case, invalidated the EU–US Privacy Shield framework, finding that US surveillance laws (such as FISA Section 702 and Executive Order 12333) did not give EU citizens protection 'essentially equivalent' to the GDPR. The court left Standard Contractual Clauses (SCCs) valid but said data exporters must assess the destination country's protections and add 'supplementary measures' where they fall short.

For Dropbox — a US company subject to US legal process and the CLOUD Act — the ruling created a durable compliance problem for its EU customers. Dropbox says it is GDPR-compliant, adheres to the EU Cloud Code of Conduct, and offers EU-based data centers for some enterprise tiers, but it cannot guarantee EU-only hosting across all plans, and it cannot place EU customer data beyond the reach of US legal demands. EU organizations using Dropbox must therefore perform transfer-impact assessments and may need additional encryption or contractual measures to use it lawfully.

This is not a breach or a Dropbox-specific failing — it applies to all major US cloud providers — but it is a structural privacy and legal exposure that EU users of Dropbox carry, and it connects directly to the government-access concerns documented elsewhere in this archive.

Impact

Schrems II turned 'where is my data legally reachable?' from a niche worry into a compliance obligation for every EU organization using US cloud storage. For Dropbox it underscores that GDPR certifications and EU data centers do not neutralize US jurisdiction — the same root issue behind the PRISM and transparency-report concerns. It is a key reason privacy-sensitive EU users look to EU-based or zero-knowledge alternatives.

Dropbox's Response / Official Position

Dropbox publishes GDPR and compliance documentation, states it adheres to the EU Cloud Code of Conduct (Compliance Mark Level 2 for team plans), uses Standard Contractual Clauses, and offers EU-region data storage for some enterprise customers — while acknowledging it operates as a US provider.

Sources

Related guides

Spot an error, or have a source to add?
Report an error / suggest update

Related issues

On 10 September 2026 Dropbox announced, together with OpenAI, a native Dropbox experience inside ChatGPT. Users who connect their account can browse, search, @mention and preview Dropbox files there. Four Dropbox pages captured for this entry describe permissions and a per-user disconnect path, but none of them states whether content sent to ChatGPT is used to train models, how long OpenAI retains it, or any admin switch to block the connector.

Privacy & Encryption ConcernsDeveloper, API & Platform
Read documentation

Between March 2025 and April 2026 four patent-infringement complaints were filed against Dropbox in the District of Delaware, the Western District of Texas (two suits) and the Southern District of New York. Three were voluntarily dismissed by the plaintiffs within about seven weeks to three and a half months; the fourth, VE Opening, was transferred from Texas to California in July 2026 and is still open. The captured dockets do not show what any court decided on the merits; the VE Opening docket lists a motion for judgment on the pleadings and an order on it whose content was not captured.

Legal Actions & LawsuitsCurrent / Ongoing Issues (2024–2026)
Read documentation
1 source

An Israeli physician sues over a blocked Dropbox account: an untested allegation from a single report

Untested, single-source: Calcalist/CTech reported on 11 August 2026 that a senior physician at an Israeli hospital has sued the Dropbox entity registered in Ireland over an account that, according to the lawsuit, was blocked without prior warning, a hearing or an explanation. He denies ever storing the material Dropbox is said to have cited. None of it has been tested in court, Dropbox had not filed a response when the report appeared, and this entry rests on that one report.

Legal Actions & Lawsuits
Read documentation

Because Dash can be downloaded and set up with 'no sales or IT required,' an individual employee can connect and index an organization's apps and browser history without administrator oversight — recreating the shadow-IT data-governance risk that earlier consumer Dropbox use posed to enterprises.

Privacy & Encryption ConcernsCurrent / Ongoing Issues (2024–2026)Account Lockouts & Support Failures
Read documentation