What is the new EU-US Data Privacy Framework?

The EU-US Data Privacy Framework (DPF) is a mechanism for transferring personal data from the EU/EEA to participating US organisations. It operates under the European Commission’s adequacy decision adopted on 10 July 2023, which recognises adequate protection for transfers covered by the framework.

Before relying on it, check the recipient’s active EU-US certification and the relevant data coverage through the official Data Privacy Framework List. Certification applies to participating organisations, rather than all businesses in the United States.

For covered transfers, standard contractual clauses are not required as an additional transfer mechanism. However, other GDPR obligations still apply, including lawful processing, transparency and a data processing agreement where the recipient acts as a processor. Transfers outside the framework need another valid transfer mechanism.