EU-US DPF
EU-US Data Privacy Framework
An adequacy decision letting personal data flow to self-certified US companies without standard contractual clauses.
The law in brief
The EU-US Data Privacy Framework lets personal data flow from the EU to US organizations that self-certify to it, without standard contractual clauses or other transfer tools. It rests on a European Commission adequacy decision adopted on 10 July 2023 and on US commitments limiting intelligence access to data, with a new redress route through the Data Protection Review Court.
There are matching arrangements for the UK (the UK Extension) and Switzerland (the Swiss-US DPF).
Who it applies to
- US organizations subject to the jurisdiction of the Federal Trade Commission or the Department of Transportation that self-certify with the US Department of Commerce and publicly commit to the DPF Principles.
- EU exporters sending personal data to a certified organization, which can rely on the adequacy decision for data within the scope of that organization's certification.
- Human resources data is covered only if the organization certified for it.
What it requires
Self-certify and recertify
US organizations must self-certify to the Department of Commerce, commit publicly to the DPF Principles, and recertify annually.
Notice and choice
Tell individuals about the data collected, purposes, recipients and their rights, and give them a choice before disclosure to third parties or use for materially different purposes; sensitive data needs affirmative consent.
Accountability for onward transfer
Transfer data to third parties only for limited, specified purposes under contracts requiring the same level of protection.
Security, integrity and access
Protect data with reasonable measures, keep it only as long as it serves the purpose, and give individuals access and correction.
Recourse and enforcement
Provide an independent recourse mechanism at no cost to individuals and respond to complaints; binding arbitration is available as a last resort.
People's rights
EU individuals can access and correct their data held by a certified organization, opt out of disclosure to third parties and of use for materially different purposes, bring complaints free of charge to an independent recourse mechanism, and, as a last resort, invoke binding arbitration. They can also complain about US intelligence access through their data protection authority to the Data Protection Review Court.
Enforcement and penalties
The FTC and the Department of Transportation enforce the commitments of certified organizations, including against false claims of participation. The Department of Commerce can remove organizations that persistently fail to comply.
What's changing
Upheld, under appeal. The EU General Court dismissed a challenge to the framework on 3 September 2025 (Latombe v Commission, T-553/23). The appeal is pending before the Court of Justice (C-703/25 P). If the framework falls, transfers relying on it would need another tool, so keep a fallback ready.
What to do first
- As an exporter, check the DPF List for the recipient's active certification and that it covers the data you send, including HR data.
- As a US organization, self-certify, publish a compliant privacy policy, choose an independent recourse mechanism, and recertify every year.
- Put onward transfer contracts in place with your own vendors.
- Keep a fallback: standard contractual clauses and a transfer impact assessment ready if the framework is invalidated.
- Track the appeal and the Commission's periodic reviews.
Checked against the official text on 28 September 2026. Quotations are the operative words of the law, linked to the article they come from; the official text is the authority. This brief is written by the Association for practitioners and is not legal advice.
Recent developments
Nothing reported yet. Regulatory Watch lists new rules, enforcement and court decisions as they arrive.
Sources
- Commission Implementing Decision (EU) 2023/1795 on the EU-US Data Privacy Framework EUR-Lex · Official text or regulator