EU-US Data Privacy Framework

What it means

The EU-US Data Privacy Framework is the framework under which personal data may be transferred from the EU to US companies certified under it. In 2023 the European Commission decided that such companies provide an adequate level of protection, so transfers need no further safeguards.

It replaced the Privacy Shield, which the EU Court of Justice annulled for failing to protect against access by US intelligence agencies. The new framework introduced limits on such access and a redress mechanism for EU citizens, and in 2025 the EU General Court dismissed an action against it.

It is one of the tools for international data transfers under the GDPR. If the recipient is not certified, another tool is needed, typically standard contractual clauses together with a transfer risk assessment.

How it works in practice

Before a transfer, check that the specific US recipient is on the list of certified organisations and that its certification covers the type of data concerned, such as employee HR data. Certification is voluntary and must be renewed every year.

Most companies transfer data to the US indirectly, through cloud services, e-mail tools, CRM or analytics. Records of processing and privacy notices must state that transfers take place and on what basis.

For riskier processing, such as large volumes of sensitive data, a data protection impact assessment is advisable. Many providers combine certification with standard contractual clauses to have a fallback basis in case the framework changes.

What to watch out for

The framework's future is not certain. The court struck down the two previous frameworks, and further challenges cannot be ruled out. Companies should have a plan, such as contractual clauses or the option to move data to the EU, should the framework fall.

Certification covers only the organisation that obtained it, not its subcontractors. With suppliers that use a wide network of sub-processors, the whole chain must be checked and the contract should require notice of changes in sub-processors.