EU-US Data Privacy Framework
Also known as: DPF, EU-U.S. Data Privacy Framework, Trans-Atlantic Data Privacy Framework, Privacy Shield successor
The EU-US Data Privacy Framework (DPF) is the arrangement that allows personal data to flow from the European Union to US companies that certify their compliance with its principles.
It's the third attempt at such a deal, after Safe Harbor and Privacy Shield were both struck down by the EU's top court. While it has survived its first legal challenge, its stability still depends on US surveillance safeguards that can change with an administration.
EU-US Data Privacy Framework, explained at three levels
At home
Think of the Data Privacy Framework as a membership club for US companies. To join, a company publicly promises to follow European-style privacy principles, and the US government adds limits on how its spy agencies can access that data. If you're in the EU and a club member processes your data in the US, the transfer is legal without extra contracts.
At work
The DPF is a European Commission adequacy decision that covers US organizations which self-certify with the Department of Commerce. Certified companies commit to principles on notice, choice, purpose limits, security, and onward transfers, enforced by the Federal Trade Commission or the Department of Transportation. Businesses care because EU organizations can send personal data to a certified US company without signing standard contractual clauses.
At home
The DPF gives you two kinds of protection. Against companies, you can complain directly to the firm, use a free independent dispute resolution body, go to your national data protection authority, or, as a last resort, use binding arbitration. Against US intelligence agencies, you file a complaint through your national authority. It goes first to a Civil Liberties Protection Officer in the US intelligence community, and can then be appealed to the Data Protection Review Court.
At work
In practice, the DPF only covers organizations on the public DPF List, and only for the types of data they certified, such as human resources data or customer data. Certifications must be renewed every year, so a lapsed listing means the transfer needs another mechanism. Many companies keep standard contractual clauses as a backup in case the framework falls. The UK Extension and the Swiss-US framework use the same certification for transfers from those countries.
At home
The core legal question is whether US surveillance, especially under Section 702 of FISA and Executive Order 12333, is 'necessary and proportionate' under EU law. Executive Order 14086 wrote those standards into US intelligence rules and created the redress court. The EU General Court upheld the framework in September 2025, and the challenger appealed to the Court of Justice. In my view, the weakness is that an executive order can be changed by a future president, which is why challenges keep coming.
At work
Risk management for EU-US transfers usually layers DPF certification, standard contractual clauses as a fallback, transfer impact assessments for non-certified recipients, and technical measures such as encryption with keys held in the EU. The framework's durability depends on US oversight bodies, and the 2025 removal of members from the Privacy and Civil Liberties Oversight Board raised questions about it. Firms should watch the Commission's periodic reviews and the pending appeal at the Court of Justice.
Real-world examples
At home
Marcus, living in Dublin, wondered if his photos were safe on a US cloud storage service. He checked and found the company was certified under the Data Privacy Framework, which meant it had committed to EU-standard privacy principles for his data.
At work
Sophie is the data protection officer at a German retailer using a US analytics provider. She confirmed the provider's DPF certification but kept standard contractual clauses in the contract as a fallback, given how the two previous frameworks ended.
How it compares
| feature | EU-US Data Privacy Framework | Privacy Shield | Safe Harbor |
|---|---|---|---|
| Years in effect | 2023 to present | 2016 to 2020 | 2000 to 2015 |
| Fate | Upheld by the General Court in 2025, appeal pending at the Court of Justice as of 2026 | Struck down in Schrems II | Struck down in Schrems I |
| Surveillance safeguards | Executive Order 14086, Data Protection Review Court | Ombudsperson mechanism | Minimal |
| How companies join | Self-certification with US Commerce | Self-certification | Self-certification |
Each framework tried to fix the last one's surveillance gaps; the DPF goes furthest but still depends on executive action.
For analysts
Never rely on a single transfer mechanism for critical EU-US data flows. I'd keep SCCs in every contract as insurance, because two frameworks have already been struck down with little warning.
History & origin
The first framework, Safe Harbor (2000), was invalidated by the Court of Justice of the European Union in October 2015 in a case brought by privacy activist Max Schrems. Its replacement, the EU-US Privacy Shield (2016), was struck down in July 2020 in the 'Schrems II' ruling, which found US surveillance law didn't adequately protect Europeans. To address the court's concerns, US President Biden signed Executive Order 14086 in October 2022, adding limits on intelligence activities and a new Data Protection Review Court. The European Commission adopted an adequacy decision for the DPF on July 10, 2023. In September 2025, the EU General Court dismissed a challenge to the framework, and the challenger appealed to the Court of Justice in October 2025. In my opinion, the DPF is stable for now, but it rests on executive action rather than legislation, which is a fragile foundation.