Key points

• The EU-US Data Privacy Framework (DPF) is the European Commission adequacy decision that lets personal data flow to certified US companies without further transfer tools.
• It has survived its first court challenge, but an appeal and further challenges are possible, and changes in US oversight bodies have drawn criticism from privacy advocates.
• The previous two frameworks, Safe Harbor and Privacy Shield, were both invalidated by the Court of Justice of the European Union. Prudent companies plan for that possibility.
• A fallback built on standard contractual clauses and a documented transfer impact assessment can make a future change an administrative exercise rather than a crisis.
• The exercise starts with a map of which flows rely on the DPF, which vendors certify, and how quickly you could switch.

Where the framework stands

The European Commission adopted its adequacy decision for the DPF in 2023, concluding that the United States ensures an adequate level of protection for personal data transferred to participating organizations. The decision rests in large part on US Executive Order 14086, which introduced necessity and proportionality requirements for US signals intelligence and created a redress mechanism that includes the Data Protection Review Court.

The framework is voluntary for US companies, which self-certify to the Department of Commerce and commit to the DPF principles. For European exporters, relying on the decision means they do not need to put standard contractual clauses in place or carry out a transfer impact assessment for transfers to a certified recipient. That simplicity is why so many organizations built their transatlantic data architecture around it.

The legal and political pressure

The first annulment challenge was brought before the EU General Court, which dismissed it, and the case has been taken on appeal to the Court of Justice. The Court of Justice has twice before invalidated an adequacy arrangement with the United States, in the Schrems I and Schrems II judgments, each time because of concerns about US surveillance law and the lack of effective redress. Other challenges, including by privacy organizations, remain possible.

Political developments in the United States have added to the uncertainty. The framework depends on the independence of US oversight institutions and on executive orders that can in principle be amended or revoked. Changes affecting independent oversight bodies have been cited by critics as undermining the assessment on which the Commission relied. The Commission has said it keeps the framework under review, and periodic reviews continue.

Why a stress test makes sense

None of this means the DPF is about to fail. It means the cost of being wrong is lopsided. If a decision were struck down, there could be little or no grace period, and companies would need to put an alternative transfer mechanism in place for every affected flow. Regulators would expect them to have thought about it. In the previous invalidations, organizations that had a documented fallback adapted quickly, and those that did not spent months in remediation.

How to stress-test

Start with a data map. List every transfer to the United States that relies on the DPF: intra-group transfers to US affiliates, cloud and software vendors, HR and payroll platforms, marketing and analytics tools, and professional advisers. Note the categories of data, the volume and the sensitivity.

Check certification. Confirm on the Department of Commerce list that each recipient is currently certified, that the certification covers the type of data being transferred (for example human resources data) and that it has not lapsed. Lapses happen more than companies expect, and a transfer to an uncertified recipient has no DPF basis.

Check the contracts. Where vendors rely on the DPF alone, ask whether the data processing agreement also incorporates standard contractual clauses that would apply automatically if the framework fell away. A conditional fallback clause costs little to negotiate now and saves time later.

Prepare the assessments. If you needed to switch to standard contractual clauses, you would also need a transfer impact assessment. The Commission’s adequacy decision and the safeguards of Executive Order 14086 are relevant to assessing US law, and the European Data Protection Board has said that the safeguards of that order apply to all transfers to the United States regardless of the tool used. Many companies are therefore preparing assessments that can be adopted quickly.

Related regimes

The United Kingdom has its own data bridge with the United States, which operates as an extension of the DPF and depends on the same certification. Switzerland has a separate Swiss-US framework. A company that certifies should confirm which of the three it has joined, and non-US companies should check the tool used for each jurisdiction. Companies that also hold data on EU residents under the GDPR should remember that onward transfers from the US recipient require the recipient to apply equivalent protections.

Beyond adequacy

Even with an adequacy decision, other regulatory questions remain. The GDPR requires controllers to be able to demonstrate compliance, to carry out data protection impact assessments for high-risk processing and to be transparent about transfers in privacy notices. Supervisory authorities have also been focusing on cloud services, analytics and artificial intelligence tools that send personal data outside the EU. Treat a transfer review as a chance to confirm that these basics are in order.

Recommendations

Do not wait for a court ruling. Complete the map, confirm certifications, add fallback clauses to key contracts and keep draft transfer impact assessments current. Assign an owner and review the position at least once a year, or when there is a significant legal development.

Helena Strand in London and Sophie Laurent-Brecht in Brussels advise multinational groups on international data transfers, including DPF reliance reviews and fallback planning.