Hybridity4 out of 5 European defence companies don’t say clearly where your data goes outside the EU.
We read 1,242 public policy documents from 124 European companies in the defence sector. Most of the gaps come from how the documents are maintained, not from how the law is read.
- Companies analysed
- 124
- Public documents
- 1,242
- Obligations checked
- 4,095
- Findings
- 1,857
In defence, size is no protection: large contractors to European governments and start-ups show the same gaps
We analysed 1,242 public policy documents from 124 European defence companies: the prime contractors to European governments and their national subsidiaries; makers of military platforms such as aircraft, warships and armoured vehicles; suppliers of defence electronics, sensors, engines and space systems; maintenance and software providers; and defence-tech companies focused on drones, robotics and AI. From these we recorded 1,857 findings, and three patterns stand out.
Outdated transfer statements. Unclear controllers. Missing routes to the authorities. Each points to the same operational problem: copies drift apart, templates outlive their source and nobody owns the dates that change. In a sector where groups buy, merge, rename and carve out companies at pace, the published text often lags behind.
Three questions the published documents leave unanswered.
Each figure counts only the companies we could check for that requirement, so the base varies.
Where does the data go?
At least one privacy notice leaves out, or gets wrong, where personal data goes outside the EU/EEA or the UK, and on what safeguard. In 16 of these 86 companies, the text predates a change in the rules. It still relies on Safe Harbor or the Privacy Shield, tells readers the US has no adequacy decision, or describes a UK company’s transfers in EU terms.
Who is responsible?
At least one privacy notice leaves out, or gets wrong, which company is responsible for the data or how to reach it. A visitor, applicant or supplier cannot tell which company answers for their data, or where to send a request. In 45 of these 88 companies, the notice speaks for a group, a brand or “we”, or leaves the controller to “whichever group company you deal with”.
Where can someone report?
The whistleblowing page does not fully explain how to report to a competent authority. The page is public, so the gap is visible to any employee, supplier or journalist. Of these 42 companies, 19 never mention an external reporting channel.
Why the same problems keep appearing
Across the documents we reviewed, we kept seeing three problems: different versions of the same notice, unfinished templates and information that had not been updated after a change.
One version gets updated. The others don’t.
A privacy notice may appear on the group website, several subsidiary sites and in downloadable PDFs, often in more than one language. Updating the English webpage does not update the German version or the PDF. Unless someone checks every copy, readers can get different answers depending on where they look.
The template is published before it is finished.
Some notices refer to “the group” without naming the company responsible for the reader’s data. Others still contain blanks for company details. Whistleblowing pages explain how to use the internal hotline but leave out where to report to an authority. The text has been published without all the details a reader needs.
The company or the law changes. The page stays the same.
An acquisition or a change of name can leave a notice referring to the wrong company. Changes to data transfer rules and national whistleblowing laws can make published information out of date too. We found pages that still gave the old information, with no sign that anyone had revisited it.
English webpage
v1Privacy ShieldEU–US Data Privacy Framework
German webpage
v1Privacy ShieldEU–US Data Privacy Framework
PDF download
v1Privacy ShieldEU–US Data Privacy Framework
All three copies still refer to the Privacy Shield.
Separate copies: one English-page edit leaves the German webpage and PDF unchanged. Shared source: the revised wording flows to all publication paths.
Three examples from the documents we reviewed
These examples show what readers are left unsure about and how the wording could be made clearer.
| Example | Gap found | Proposed fix |
|---|---|---|
| The English and German notices name different safeguards for the same data transfer. | In the contact-form section, the English version names the EU–US Data Privacy Framework as the basis for transfers to the US. The German version of the same sentence still names the Privacy Shield, which the Court of Justice struck down in 2020. | “Transfers to [provider] in the United States rely on the European Commission’s adequacy decision for the EU–US Data Privacy Framework (Implementing Decision (EU) 2023/1795); [provider] is certified under the Framework.” GDPR Art. 13(1)(f) |
| The privacy notice still has blanks where the company’s details should be. | The controller section of the website privacy notice still shows the template’s placeholders where the company name, address, email and phone number belong. A reader cannot tell which company holds their data. | “[Legal name] ([registration number]), [postal address], is the controller of the personal data described in this notice. Privacy questions: [privacy mailbox].” GDPR Art. 13(1)(a) |
| The reporting guidance for Poland has not been updated to reflect the new law. | The whistleblowing policy’s annex lists external reporting channels country by country. For Poland it says the directive has not been transposed, although Poland’s whistleblower act has applied since 25 September 2024. | “Poland: the Commissioner for Human Rights (Rzecznik Praw Obywatelskich) and the public authority competent for the area concerned (Act of 14 June 2024 on the protection of whistleblowers).” Ustawa o ochronie sygnalistów (Dz.U. 2024 poz. 928) · Directive (EU) 2019/1937 Art. 9(1)(g) |
From a policy update to action
A subsidiary changes its name after an acquisition. Follow this example through the rulebook, tasks and review.
01Snapshot
Your public documents checked against the rules that apply.
02Rulebook
Policies become rules, one line each, traced to the source clause.
03Tasks
Every gap gets an owner; evidence is checked as it arrives.
04Kept current
A change to a rule, amount or authority flags what it touches.
Hybridity turns policies into rules with owners, tasks and evidence, and flags what a change touches. Closing compliance gaps before they become barriers, so you can move faster.
Get your gap analysis
See what your public documents say today, and what it takes to close the gaps.
Source: Hybridity Regulatory Exposure Snapshots, Q4 2026, week 3. 124 European defence companies. 1,242 public documents read and 4,095 obligations checked.
Markets: Germany (28 companies), the UK (18), Sweden (16), France (12), Finland (8), Italy (6), the Netherlands (5) and Spain (5); the Czech Republic, Poland, Denmark, Norway, Switzerland, Belgium, Estonia, Austria, Cyprus, Latvia, Luxembourg and Portugal (26 companies combined). No single market makes up more than a quarter of the sample. Percentages are rounded and use a different checked base for each requirement.
Regulatory areas: GDPR, UK GDPR and Swiss data protection law, cookies and ePrivacy, whistleblowing, supply-chain and modern-slavery disclosures, statutory company information and website imprints, UK corporate reporting (tax strategy, gender pay gap, carbon reduction plans), market disclosure rules, accessibility, US state privacy law, and document control.
A finding is a statement about a document, never a verdict on the company. Obligations that can only be evidenced internally have not been counted.