What is the EU-US Data Privacy Framework?

The EU-US Data Privacy Framework is an adequacy decision the European Commission adopted on 10 July 2023, under Article 45(3) of the GDPR. With it, the Commission declares that the United States offers, for companies that join the framework, a level of personal data protection that is essentially equivalent to that of the European Union. The decision covers any US company that completes the self-certification process described below, regardless of its sector.

That declaration has a direct practical effect. When a European company transfers data to a certified US organization under the framework, it needs no additional safeguard and does not need prior authorization from its data protection authority. Neither Standard Contractual Clauses (SCC) nor a transfer impact assessment are required, because the Commission's decision already covers the transfer as if the recipient were located within the European Union.

SCC remain in place as an alternative mechanism, used to transfer data to providers that are not certified under the framework, or to third countries without their own adequacy decision. The difference lies in origin: the adequacy decision comes from the Commission and covers an entire country for a specific purpose, while SCC are a contract between the two parties transferring the data, with obligations each company must negotiate and document on its own. The framework does not replace SCC, it gives a simpler alternative for data traffic with the United States.

The mechanism relies on a public register, the Data Privacy Framework List, maintained by the US Department of Commerce. A US company that wants to receive personal data from the EU under this framework must self-certify with the Department of Commerce, committing in writing to a set of data protection principles: clear notice about the processing, choice for the data subject, purpose limitation and data minimization, security and data integrity, access and rectification rights, and complaint and accountability mechanisms for European citizens.

Once self-certification is complete, the company appears on the public list, together with the date it joined and the specific scope of data it covers. From that point, any EU company can transfer it personal data by relying directly on the Commission's adequacy decision, without needing to sign SCC or justify the transfer case by case before any authority.

The critical point is verification: certification is a self-declaration by the US company, not a prior audit by a European body. Oversight happens afterward, through the US Federal Trade Commission (FTC), which can sanction companies that fail to meet their stated commitments, and through the complaint mechanisms built into the framework itself, including an independent review court, the Data Protection Review Court, for cases involving access by intelligence services.

For a European company, the practical check before sending data to a US provider is simple: look up whether that specific provider, under that exact legal name, is listed as active on the Data Privacy Framework List. Being certified for one type of data does not mean being certified for all of them: the list specifies the scope of each certification, and it is worth keeping a dated screenshot or note of that check to be able to demonstrate it later.

A very concrete decision depends on this framework for anyone running a website or online store in Europe: whether tools like GA4, Google Ads or the Meta Pixel can be used without additional safeguards, because the data they collect travels to servers in the United States for processing.

That question has already been answered twice before, and both times the answer changed. The Court of Justice of the EU struck down the Safe Harbor agreement in 2015 (the Schrems I ruling) and its successor, the Privacy Shield, in 2020 (the Schrems II ruling, Case C-311/18), in both cases over US authorities' access to the data without safeguards equivalent to the European ones. The Data Privacy Framework is the third attempt, designed specifically to fix the problems the Court identified regarding US intelligence services' access to European data.

That history is why the current framework has already gone through its own judicial review. The General Court of the European Union, in a ruling of 3 September 2025 (Case T-553/23, Latombe v Commission), fully dismissed the action brought against the adequacy decision and confirmed that the level of protection in the United States is essentially equivalent to the European one. The ruling is a first-instance decision and can still be appealed, so the framework remains, by design, subject to review, and anyone relying on it to run analytics or advertising tools does well to keep following how it develops.

• Check whether each tool's provider (Google, Meta, HubSpot, etc.) is listed as active on the Data Privacy Framework List, under the exact legal name of the entity receiving the data.
• Review the scope of that provider's certification: it covers specific data types, not automatically every product the company offers.
• Document in the record of processing activities which transfers rely on the framework and which still need SCC.
• Monitor whether the provider keeps its certification active: removal from the list is not always communicated clearly to customers.
• Keep an alternative (SCC) ready for tools or providers that are not certified under the framework.
• Follow the Court of Justice of the EU's case law on the framework, since an appeal against the September 2025 ruling could change the situation.

• Assuming every US company is covered by the framework: only those that have self-certified and remain active on the list are.
• Confusing the framework with a technical security certification: it is a legal compliance commitment, not a cybersecurity audit.
• Treating the current framework as final because its two predecessors, Safe Harbor and Privacy Shield, were struck down by the Court of Justice of the EU.
• Forgetting that certification has a limited scope by data type and does not automatically cover every service from the same provider.
• Not recording the date a certification was checked: the list changes, and a check from a year ago is no proof of the current status.