EU-US Data Privacy Framework
In force European Union · In force Jul 10, 2023 · no upcoming deadlines
Deadlines
Summaries for reference, not legal advice. Check the official text.
What it does
GDPR Art 45 adequacy decision letting personal data flow from the EEA to US organisations self-certified under the Data Privacy Framework with the US Department of Commerce, with no further transfer mechanism needed. It relies on US Executive Order 14086 safeguards and the Data Protection Review Court for redress. The EU General Court upheld it in Latombe v Commission (T-553/23) on 3 Sep 2025, and an appeal is pending before the Court of Justice.
- Who it applies to
- EEA exporters transferring personal data to US organisations on the DPF List (self-certified, under FTC or DOT jurisdiction). Transfers to non-certified US recipients still need SCCs/BCRs, which benefit from the same US safeguards.
- Penalties
- No standalone fines; unlawful transfers fall under GDPR Art 83(5) (up to EUR 20M or 4% of worldwide turnover). US certified organisations face FTC/DOT enforcement.
- Enforced by
- European Commission (monitoring, periodic review); EU data protection authorities; US Department of Commerce, FTC and DOT
- Official name
- Commission Implementing Decision (EU) 2023/1795 on the adequate level of protection of personal data under the EU-US Data Privacy Framework
- Citation
- OJ L 231, 20.9.2023, p. 118 (notified under document C(2023)4745)
- Topics
- privacy, data-residency
Research notes
Art 3(4) required a first review one year after notification. The Commission completed the first periodic review in October 2024 (exact date not re-verified here), with the next review expected after about three years. Appeal case number C-703/25 P and the 31 Oct 2025 lodging date come from secondary sources, not CURIA directly. No CJEU hearing or judgment was found as of the research date. The decision's validity also depends on US safeguards (EO 14086, PCLOB functioning), which the Commission monitors.
Related
Questions about EU-US Data Privacy Framework
- What are the EU-US Data Privacy Framework compliance deadlines?
- Jul 10, 2023: DPF adequacy decision adopted and effective. Sep 3, 2025: General Court upholds DPF (Latombe v Commission). Oct 31, 2025: Latombe appeal lodged at the Court of Justice.
- When does EU-US Data Privacy Framework take effect?
- EU-US Data Privacy Framework took effect on Jul 10, 2023.
- Who does EU-US Data Privacy Framework apply to?
- EEA exporters transferring personal data to US organisations on the DPF List (self-certified, under FTC or DOT jurisdiction). Transfers to non-certified US recipients still need SCCs/BCRs, which benefit from the same US safeguards.
- What are the penalties under EU-US Data Privacy Framework?
- No standalone fines; unlawful transfers fall under GDPR Art 83(5) (up to EUR 20M or 4% of worldwide turnover). US certified organisations face FTC/DOT enforcement.