All regulations / EU Privacy
EU-US Data Privacy Framework
Know the rule before it knows you.
The current legal bridge for personal data flowing to the United States.
What it is
The DPF lets EU companies transfer personal data to US companies that self-certify to the framework without extra safeguards. The EU General Court upheld the decision in September 2025; an appeal to the Court of Justice is pending. Most transfers still rely on standard contractual clauses as a fallback.
This applies to you if
- You use US-based cloud, SaaS, analytics, AI or marketing vendors
- You are a US company receiving data from EU customers or partners
- You run a group with US entities
What it asks of you
- Verify certification of each US recipient on the DPF list
- Keep standard contractual clauses and a transfer impact assessment as a fallback
- Map all transfers in your record of processing; update privacy notices
What it costs to ignore
Transfers without a valid mechanism are GDPR breaches, with fines up to 4% of turnover and orders to suspend data flows.
Key dates
Adequacy since 10 July 2023; General Court judgment 3 September 2025; appeal lodged 31 October 2025, pending.
How we help
Not sure which apply to you? Send us three lines about what you sell and to whom, and we will tell you which rules matter and which do not.
Have a regulatory question?
Send a short description of your situation. We reply within one working day, usually with a view on scope and a fixed fee where possible.