The EU-US Data Privacy Framework (DPF) is the third attempt to give transfers of personal data from Europe to the United States an adequacy basis, and the first two were struck down by the Court of Justice. Since 10 July 2023, EU and EEA organisations can send personal data to US companies that have self-certified to the DPF without signing Standard Contractual Clauses for that flow. The framework comes with a UK Extension and a parallel Swiss-US DPF, a US redress route built on Executive Order 14086, and a legal challenge that is still before the Court of Justice. This guide explains who can rely on the DPF, what certified US organisations commit to, where the legal status stands as of October 2026, and how security, privacy and identity teams should build transfers that survive if the framework falls. It is written for privacy leads, DPOs, security architects and procurement teams on both sides of the Atlantic.
Key takeaways
- Adequacy covers certified recipients only. The Commission's decision of 10 July 2023 applies to US organisations on the Data Privacy Framework List, not to the United States as a whole, so every DPF transfer starts with checking the recipient's active certification.
- The General Court upheld the framework, but the appeal is pending. The General Court dismissed the Latombe challenge on 3 September 2025 (Case T-553/23), and an appeal was lodged on 31 October 2025 (Case C-703/25 P).
- UK and Swiss transfers have their own legal acts. The UK Extension took effect on 12 October 2023 under UK adequacy regulations, and the Swiss-US DPF entered into force on 15 September 2024.
- US oversight bodies are a known weak point. The Privacy and Civil Liberties Oversight Board (PCLOB), which has a defined role under EO 14086, lost its quorum after three members were dismissed on 27 January 2025.
- Keep a fallback ready. Map every DPF flow, keep SCCs and transfer impact assessments available for critical vendors, and treat machine-to-machine data flows and AI agent tool calls as transfers too.
Scope: who and what is covered
The DPF is an adequacy decision under Article 45 GDPR, Commission Implementing Decision (EU) 2023/1795, adopted on 10 July 2023 and published in the Official Journal on 20 September 2023. It followed the invalidation of the EU-US Privacy Shield in the Schrems II judgment of July 2020.
The three frameworks
| Framework | Legal act on the exporting side | Effective date | Who can receive data |
|---|---|---|---|
| EU-US DPF | Commission Implementing Decision (EU) 2023/1795 (Art. 45 GDPR) | 10 July 2023 | US organisations self-certified to the EU-US DPF |
| UK Extension to the EU-US DPF ("UK-US data bridge") | Data Protection (Adequacy) (United States of America) Regulations 2023, laid 21 September 2023 | 12 October 2023 | US organisations certified to the EU-US DPF that have also opted in to the UK Extension |
| Swiss-US DPF | Federal Council decision of 14 August 2024, amending the Data Protection Ordinance | 15 September 2024 | US organisations certified to the Swiss-US DPF |
Who can certify
- Eligible organisations: US legal entities subject to the investigatory and enforcement powers of the Federal Trade Commission (FTC) or the Department of Transportation. Bodies outside those jurisdictions, such as many banks and non-profits, cannot self-certify and need another transfer tool.
- Self-certification: the organisation certifies to the US Department of Commerce, publishes a compliant privacy policy, names an independent recourse mechanism and recertifies every year. Organisations that lapse are removed from the active list but remain bound for data received while certified.
- Data in scope: the certification states which data it covers, typically "non-HR" (customer, prospect, user) data, "HR" data about employees, or both. An organisation certified only for non-HR data cannot receive EU employee records under the DPF.
- Exporters: any EU or EEA controller or processor, of any size, can rely on the decision for transfers to a listed organisation, within the scope of that organisation's certification. The same logic applies on the UK and Swiss sides.
The DPF does not cover transfers to US entities that are not certified, onward recipients that are not bound by contract, or US public authorities. For those, see the Standard Contractual Clauses (SCCs) Guide and the International Data Transfers Map.
Key obligations
Obligations fall on two parties: the certified US organisation, which signs up to the DPF Principles, and the European exporter, which still has its own GDPR duties. The principles are enforceable in the US through the FTC, which states that a participant's failure to comply with the Principles may violate Section 5 of the FTC Act on unfair and deceptive practices.
The DPF Principles for US participants
| Principle | What it requires | Security and identity implication |
|---|---|---|
| Notice | Tell individuals about participation, purposes, recipients, rights and the recourse mechanism | Privacy notices must list the independent recourse body and the DPF participation |
| Choice | Opt-out for new purposes and disclosures to third parties; opt-in for sensitive data | Consent and preference state must flow to every system that processes the data, including integrations |
| Accountability for Onward Transfer | Contracts with third parties and agents that limit purpose and require the same level of protection | Sub-processors, SaaS integrations and API partners need written terms and a register |
| Security | Reasonable and appropriate measures against loss, misuse and unauthorised access | Access control, credential hygiene, logging and encryption are the evidence |
| Data Integrity and Purpose Limitation | Data relevant, accurate and used only for compatible purposes; retained only as long as needed | Retention jobs and service account scopes should reflect stated purposes |
| Access | Individuals can access, correct or delete inaccurate data | Subject access processes must reach data held in logs, backups and AI pipelines |
| Recourse, Enforcement and Liability | Independent dispute resolution, verification of compliance, liability for onward transfer failures | Annual verification (self-assessment or outside review) needs evidence of controls |
Supplemental Principles add detail on sensitive data, journalism, HR data, due diligence and audits, the role of data protection authorities, and the binding arbitration option of last resort.
Obligations that stay with the European exporter
- Lawful basis and transparency: the DPF solves Chapter V only. Articles 5, 6, 13 and 14 GDPR still apply, and privacy notices should name the US recipients or categories. See the GDPR Compliance Guide for Security Teams.
- Article 28 terms: a US processor certified to the DPF still needs a data processing agreement.
- Certification checks: verify the recipient is active on the list, covers the right data category and, for UK data, has joined the UK Extension.
- Records: the record of processing should show the transfer tool for each flow. See the Data Mapping and ROPA Guide.
The US government access safeguards
The adequacy finding rests on Executive Order 14086, "Enhancing Safeguards for United States Signals Intelligence Activities", signed on 7 October 2022. It requires signals intelligence to be necessary and proportionate to defined national security objectives, and sets up a two-layer redress route: a complaint is first reviewed by the Civil Liberties Protection Officer in the Office of the Director of National Intelligence, and can then be appealed to the Data Protection Review Court (DPRC). European individuals file complaints through their national data protection authority, not directly in the US. These safeguards apply to US intelligence access to data transferred under any tool, which is why they also help SCC transfer impact assessments.
Timeline and current status
| Date | Event |
|---|---|
| July 2020 | Court of Justice Schrems II judgment invalidates the EU-US Privacy Shield |
| 7 October 2022 | President Biden signs Executive Order 14086 |
| 10 July 2023 | Commission adopts the EU-US DPF adequacy decision (EU) 2023/1795 |
| 12 October 2023 | UK Extension (UK-US data bridge) takes effect |
| 15 September 2024 | Swiss-US DPF enters into force |
| 9 October 2024 | Commission publishes its report on the first periodic review |
| 27 January 2025 | Three PCLOB members dismissed; the board loses its quorum |
| 3 September 2025 | General Court dismisses Latombe v Commission (T-553/23) |
| 31 October 2025 | Appeal lodged at the Court of Justice (C-703/25 P) |
- The General Court ruling: the court rejected arguments that the DPRC lacks independence, that US law permits unjustified bulk collection, and that data security and automated decision-making protections fall short. It assessed the decision against the legal and factual context at the time it was adopted in July 2023, so later US changes were outside its review.
- The appeal: Mr Latombe's appeal in Case C-703/25 P was pending at the time of writing (October 2026). We found no Court of Justice judgment. A Court of Justice ruling binds the whole EU and could annul the decision with immediate effect, as happened with Safe Harbour and Privacy Shield. Check the Court's case page before relying on this summary.
- The first periodic review: the Commission's report of 9 October 2024 found that the US had put the necessary structures in place, described the DPRC as an important redress mechanism, and recommended clearer guidance for participants and stronger oversight of compliance. Further reviews are planned under the decision.
- PCLOB: under EO 14086 the PCLOB reviews intelligence agencies' implementation, is consulted on DPRC judge appointments and reports annually on the redress mechanism. The Center for Democracy and Technology reported that after the 27 January 2025 dismissals only one member remained and the board could not function as before. Track whether quorum is restored, because the Commission cited this oversight in its decision.
Enforcement and penalties
| Who | Enforces what | Tools |
|---|---|---|
| FTC (and Department of Transportation for airlines and ticket agents) | DPF Principles against certified US organisations | Section 5 FTC Act actions, consent orders, removal from the list |
| Department of Commerce | Certification, annual recertification and the list | Removal or marking as inactive, referral to the FTC for false claims of participation |
| Independent recourse mechanisms and the DPF arbitration panel | Individual complaints against participants | Dispute resolution; binding arbitration as a last resort |
| EU data protection authorities | The exporter's GDPR compliance; HR data complaints; channel for EO 14086 complaints | Article 58 orders, fines under Article 83 |
| DPRC and CLPO | Complaints about US signals intelligence | Binding remediation determinations within the US intelligence community |
For the European exporter, a transfer without a valid Chapter V basis is an Article 83(5)(c) infringement, with fines up to EUR 20 million or 4% of total worldwide annual turnover, whichever is higher. The scale is not theoretical: the Irish Data Protection Commission fined Meta EUR 1.2 billion in a decision adopted on 12 May 2023 for transfers to the US on SCCs after Schrems II, and ordered it to suspend future transfers within five months and stop unlawful storage within six. It predates the DPF, and shows the cost of being caught without a working tool.
What it means for AI agents and non-human identities
Most transatlantic personal data no longer moves through file exports. It moves through API calls, service accounts, OAuth grants, replication jobs and, increasingly, AI agents that call US-hosted models and tools. Each is a transfer when personal data reaches, or is made accessible from, the US.
- Every credential is a transfer route: a service account or API key that lets a US-hosted SaaS or model pull EU personal data is the technical form of the transfer. Your transfer register should link each DPF flow to the non-human identities that carry it. See the NHI Ownership Guide.
- Agents create onward transfers on the fly: an agent that forwards a customer record to a third-party plug-in or a US model endpoint performs an onward transfer. Under the Accountability for Onward Transfer principle the US participant must have contracts with those recipients; on the EU side, restrict the agent's tool list to vetted endpoints. See the AI Agent Authorisation Guide.
- Certification scope must match the data: AI vendors are often certified for non-HR data only. Feeding HR records into such a service through an agent breaks the DPF basis even when the vendor is listed.
- Revocation is your exit plan: if the DPF is annulled, the fastest control you have is to revoke or re-scope the tokens and keys that send data to non-SCC recipients. Know which they are in advance. See the NHI Offboarding and Decommissioning Guide.
- Logs are transfer evidence: gateway and agent logs that record destination, data category and identity are what you will show a regulator. See the AI and GDPR Guide.
Compliance steps
- Inventory US flows: list every flow of EU, UK and Swiss personal data to US recipients, including SaaS, support access, logging, analytics and AI services, with the identity or integration that carries it.
- Assign a transfer tool per flow: DPF (with certification reference), SCCs, BCRs or an Article 49 derogation. For intra-group flows see the Binding Corporate Rules (BCRs) Guide.
- Verify certifications: check the Data Privacy Framework List for active status, HR or non-HR coverage, UK Extension and Swiss-US participation. Save a dated record.
- Contract for the fallback: for critical US vendors, keep SCCs in the contract that apply automatically if the DPF ceases to be valid, and a current transfer impact assessment that can be relied on.
- Apply security safeguards regardless: encryption in transit and at rest, customer-held keys where practical, least-privilege access for vendor support and scoped service credentials. See the Encryption Guide.
- Update notices and records: name the transfer tool in privacy notices and the record of processing.
- Monitor: schedule quarterly checks of certification status and of the Court of Justice appeal, Commission reviews and PCLOB status.
- Test the exit: run a tabletop that assumes the decision is annulled on a given date. Confirm who decides, which flows stop, which move to SCCs, and how fast credentials can be revoked. Roll back by restoring flows only once a valid tool is confirmed.
Choosing between the DPF and SCCs
| Situation | Prefer | Why |
|---|---|---|
| Recipient is DPF-certified for the right data category, low-to-moderate risk data | DPF | No SCC negotiation or TIA for the Chapter V basis; simple for small organisations |
| Critical service, large volumes or special category data | DPF with SCCs as a contractual fallback | Continuity if the decision is annulled |
| Recipient not eligible (for example a bank) or not certified | SCCs with TIA | DPF is not available |
| Transfers within your own group | BCRs or intra-group SCCs | Covers the group as a whole, including non-US entities |
Small organisations often rely on the DPF alone for a handful of SaaS tools and accept the risk; large organisations with hundreds of US vendors should hold both and track which they are using.
Detection and measurement
- Certification coverage: share of US flows whose recipient certification was verified in the last 90 days (target 100%).
- Fallback coverage: share of critical US vendors with SCCs and a TIA on file.
- Unmapped egress: count of new US destinations seen in egress, CASB or API gateway logs that are not in the transfer register.
- Credential linkage: share of US-bound service accounts, API keys and OAuth grants linked to a registered flow and owner.
- Lapse response time: days from a recipient's certification lapse to remediation.
Framework mapping
| Framework | Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | GV.OC-03 | Legal and privacy obligations, including transfer rules, understood and managed |
| NIST CSF 2.0 | GV.SC-05, GV.SC-07 | Transfer terms in supplier contracts; supplier risk monitored over the relationship |
| NIST CSF 2.0 | ID.AM-07 | Data inventories that show where personal data goes |
| NIST SP 800-53 Rev. 5 | SA-9(5), AC-21, PT-2, PT-3 | Processing and storage location, information sharing, authority and purpose for processing PII |
| ISO/IEC 27001:2022 Annex A | 5.14, 5.20, 5.31, 5.34 | Information transfer, supplier agreements, legal requirements, privacy and protection of PII |
Common failure patterns
- Trusting the logo: relying on a vendor's statement that it is "DPF compliant" without checking the list, its active status and its HR or non-HR scope.
- Forgetting the UK opt-in: sending UK personal data to a US vendor certified to the EU-US DPF that has not joined the UK Extension.
- No fallback clause: contracts that rely on the DPF alone, which would force emergency renegotiation if the Court of Justice annuls the decision, as organisations had to do after July 2020.
- Ignoring sub-processors: the certified vendor forwards data to non-US sub-processors or to other US entities without onward transfer terms.
- Invisible machine flows: transfers made by integrations and agents never reach the register because only business-owned contracts are reviewed.
- Treating the DPF as a security control: adequacy settles the legal basis, not the protection of the data. Vendor access, keys and logging still need the same controls as any other processor. See the Third-Party Risk Management Guide.
Practitioner checklist
- Maintain a register of every EU, UK and Swiss personal data flow to the US with its transfer tool and carrying identity.
- Verify DPF certification status, data scope and UK or Swiss participation for each recipient, and record the date checked.
- Keep SCCs and a current transfer impact assessment for critical US vendors as a contractual fallback.
- Check that each US processor still has Article 28 terms and onward transfer commitments for its sub-processors.
- Restrict AI agents and integrations to vetted US endpoints and link their credentials to registered flows.
- Alert on new US destinations in egress and API gateway logs that are not in the register.
- Track the Court of Justice appeal C-703/25 P, Commission reviews and PCLOB status each quarter.
- Run an annual exit tabletop that assumes annulment, including revocation of US-bound credentials.
Standards and references
- EUR-Lex: Commission Implementing Decision (EU) 2023/1795 on the EU-US Data Privacy Framework
- European Commission: EU-US data transfers
- EUR-Lex: Appeal brought on 31 October 2025 by Philippe Latombe, Case C-703/25 P
- UK Government: UK-US data bridge supporting documents
- Swiss Federal Council: Swiss-US Data Privacy Framework, certified US companies offer adequate protection
- FTC: Data Privacy Framework
- Data Protection Commission: Conclusion of inquiry into Meta Ireland
- Center for Democracy and Technology: What the PCLOB firings mean for the EU-US Data Privacy Framework
Related NHI Mgmt Group resources: International Data Transfers Map · Standard Contractual Clauses (SCCs) Guide · UK GDPR and Data Protection Act 2018 Guide · Global Privacy Regulatory Map. This guide summarises the EU-US Data Privacy Framework, its UK Extension and the Swiss-US Data Privacy Framework as of October 2026 and is not legal advice.