Since the ECJ decision in Juily 2020, Schrems-II v Facebook, It has been cleared that no personal data should leave the European Economic Area, EEA, or transferred in the hands of a US Communication Provider, a principle extended to any country not benefiting from an adequacy agreement. Therefore, all legal professions regularly exchanging data outside the EEA, need to take specific measures to ensure the security of these data, at an equivalent level as the protection offered by the GDPR within the EEA. Data subjects whom data are being exported have to be informed in all transparency, of the risks associated to such data transfer.