The EU-U.S. Data Privacy Framework is the arrangement that allows personal data to be transferred from the European Economic Area to self-certified organizations in the United States without additional transfer safeguards. Under the GDPR it rests on an adequacy decision adopted by the European Commission on 10 July 2023 under Article 45, which found that participating U.S. organizations ensure an essentially equivalent level of protection.
The framework is the third attempt at such an arrangement, following Safe Harbor and the EU-U.S. Privacy Shield, both invalidated by the Court of Justice of the European Union. Its central change is a new set of limits and redress mechanisms for U.S. intelligence access to European data.
How the framework works under the GDPR
The GDPR restricts transfers of personal data to third countries unless one of the Chapter V tools applies. The adequacy decision for the Data Privacy Framework is partial and organization-specific: it covers only U.S. organizations that have self-certified with the U.S. Department of Commerce and appear on the official framework list.
A certified organization publicly commits to the framework principles and must recertify every year. Its commitments become enforceable under U.S. law, mainly by the Federal Trade Commission or, for airlines and ticket agents, the Department of Transportation. An exporter in the EU can then transfer data to that organization much as it would within the EU, while still needing a legal basis for the processing itself.
| Actor | Role | Key responsibility |
|---|---|---|
| European Commission | Adopts and reviews the adequacy decision | Periodic reviews of functioning |
| U.S. Department of Commerce | Administers the list | Processes certifications, removes lapsed members |
| Federal Trade Commission | Enforcement authority | Acts against false or broken commitments |
| Certified organization | Data importer | Applies the principles to EU data |
| EU data protection authorities | Supervisors and complaint channel | Handle complaints, HR data cooperation |
| Data Protection Review Court | Intelligence redress body | Reviews complaints about signals intelligence |
The framework principles organizations must follow
Certified organizations commit to seven core principles plus a set of supplemental principles that cover topics such as sensitive data, human resources data and journalism. The principles largely carry over from Privacy Shield, so organizations that previously complied already know the core obligations.
| Principle | What it requires |
|---|---|
| Notice | Inform individuals about processing, purposes and rights |
| Choice | Allow opt-out for new purposes and disclosures, opt-in for sensitive data |
| Accountability for onward transfer | Bind third-party recipients by contract to equal protection |
| Security | Take reasonable measures against loss and misuse |
| Data integrity and purpose limitation | Keep data relevant, accurate and limited to compatible purposes |
| Access | Let individuals see, correct and delete their data |
| Recourse, enforcement and liability | Provide free independent dispute resolution |
Individuals have a layered recourse system: a complaint to the organization, a free independent dispute resolution body, their national data protection authority, and as a last resort binding arbitration before a framework panel.
Why earlier frameworks failed and what changed
Both predecessors fell because the Court of Justice found that U.S. surveillance law allowed access to European data beyond what is necessary and proportionate, and that Europeans lacked an effective judicial remedy. The new framework responds with Executive Order 14086, signed in October 2022.
| Framework | Period | Outcome |
|---|---|---|
| Safe Harbor | 2000 to 2015 | Invalidated in the Schrems I judgment |
| EU-U.S. Privacy Shield | 2016 to 2020 | Invalidated in the Schrems II judgment |
| EU-U.S. Data Privacy Framework | Since July 2023 | In force, subject to review and litigation |
The executive order requires signals intelligence to be necessary and proportionate to defined national security objectives and creates a two-step redress path: an assessment by the Civil Liberties Protection Officer in the Office of the Director of National Intelligence, followed by review by the Data Protection Review Court. Complaints are lodged through an EU data protection authority, not directly in the United States.
Relying on the framework in practice
For an EU controller, the decisive step is verifying the importer’s active certification and that it covers the relevant data category, since certifications may cover only non-HR data or only HR data. The adequacy decision also benefits transfers under other tools, because the U.S. safeguards it relies on apply to all transfers.
| Situation | Recommended mechanism | Reason |
|---|---|---|
| Importer actively certified | Data Privacy Framework | No further transfer tool required |
| Importer not certified | SCC | Contractual safeguards with a transfer impact assessment |
| Intra-group transfers at scale | Binding corporate rules | Approved group-wide policy |
| Certification lapsed | SCC as fallback | Framework protection ends with removal |
| Uncertainty about future validity | Framework plus SCC backup | Reduces disruption if annulled |
The framework extends beyond the EU: a UK extension, often called the UK-U.S. data bridge, and a Swiss-U.S. framework allow certified organizations to receive data from the United Kingdom and Switzerland when they opt into those parts.
Risks, criticism and common misunderstandings
The framework’s durability remains legally contested. Privacy advocates argue that an executive order can be changed by a future administration and that the review court is not a fully independent judicial body. An annulment action brought before the EU General Court was dismissed in September 2025, but further appeals and new challenges remain possible.
- Self-certification is not approval: the list confirms a commitment, not an audit of compliance.
- A legal basis is still needed: adequacy governs the transfer, not the lawfulness of processing.
- Processor contracts remain mandatory when the U.S. importer acts as a processor under Article 28.
- Onward transfers from the certified importer to subcontractors must meet framework rules.
- Lapsed entries can stay visible in old documentation, so certification status should be rechecked regularly.
In plain words
European privacy law normally makes it hard to send personal data to countries with weaker protection. The EU-U.S. Data Privacy Framework is a special agreement for the United States: American companies that sign up and promise to follow European-style rules can receive European data more easily.
Think of it as a trusted-partner list. A company on the list has made binding promises and can be punished for breaking them. Europeans also get new ways to complain if they believe U.S. intelligence agencies have accessed their data unlawfully.
A real-world example
A German online retailer wants to use a U.S. customer support platform that will store names, email addresses and order histories of European customers. Before signing, its data protection officer checks the official framework list and confirms that the provider holds an active certification covering non-HR data.
The retailer signs a data processing agreement under Article 28, records the transfer in its records of processing activities and updates its privacy notice. Because the framework applies, no separate transfer impact assessment is required for this flow. As a precaution, the contract also includes standard contractual clauses that take effect automatically if the adequacy decision is annulled, so support operations would continue without interruption.