Glossary
Data Privacy Framework
Published · Last updated
Next scheduled review:
The EU-US Data Privacy Framework (DPF) is a transfer mechanism that lets personal data flow from the EU to US companies that self-certify with the US Department of Commerce.
The DPF is the third attempt at a transatlantic framework, after Safe Harbor and the Privacy Shield, both struck down by the Court of Justice. The Commission adopted the adequacy decision, Implementing Decision (EU) 2023/1795, on 10 July 2023 (EUR-Lex). It rests on US commitments in Executive Order 14086, including limits on signals intelligence and a Data Protection Review Court for complaints from the EU.
US companies join by self-certifying through the Department of Commerce's DPF program and must appear on its public list (Data Privacy Framework program, accessed 9 November 2026). An EU exporter sending data to a certified company needs no SCCs for that transfer.
The DPF has survived its first challenge. On 3 September 2025 the EU General Court dismissed an action by Philippe Latombe, a member of the French parliament (T-553/23), and upheld the framework (IAPP, 3 September 2025). Latombe appealed to the Court of Justice on 31 October 2025 (C-703/25 P), and the appeal was pending at the last verified check on 17 October 2026.
Example: A US analytics firm certified under the DPF can receive event data from a French retailer under the adequacy decision alone. If the firm's certification lapses, the retailer must switch to SCCs or stop the transfer, which is why many contracts keep SCCs on standby.
Related terms: SCC, CLOUD Act, data sovereignty, data residency, data processing agreement.