There was a very recent case which, at least for some types of data, found Cloudflare is not adequate: https://edpb.europa.eu/news/national-news/2021/census-202

There was a very recent case which, at least for some types of data, found Cloudflare is not adequate: https://edpb.europa.eu/news/national-news/2021/census-2021-portuguese-dpa-cnpd-suspended-data-flows-usa_en https://edpb.europa.eu/news/national-news/2021/census-2021-p... It looks like the court decided SCCs were not sufficient as Cloudflare is subject to US surveillance laws so they wouldn't be able to provide adequate guarantees.