EU–US Data Privacy Framework (DPF)

in English: EU–U.S. Data Privacy Framework

advancedwidespread

A rule system based on an agreement that allows the personal data of Europeans to be transferred lawfully to US companies that have joined it.

In plain terms

In the EU, your personal data is protected by strict rules, the GDPR. This protection does not cease just because data crosses a border; therefore, data can generally only be sent outside the EU if it receives adequate protection there as well.

The framework is like an expedited lane at an airport reserved for trusted passengers. The US company that commits to the rules in advance and gets on the official list can accept data from Europe without extra paperwork. Those not on the list remain in the slower lane: requiring individual contracts and risk analysis.

AI affects your daily life too. Behind most well-known chatbots, cloud services, and AI agents stands an American company, so what you type or upload often ends up on American servers. The framework is one of the main legal instruments that permits this data transfer.

It provides two types of protection. It prescribes data processing principles for companies, limits US intelligence access to what is necessary and proportionate, and opens a complaint mechanism for Europeans.

How it works

The European Commission stated in a so-called adequacy decision that US companies connected to the framework provide protection essentially equivalent to that in Europe.
The US company voluntarily certifies itself with the US Department of Commerce: it publicly commits to data protection principles (such as purpose limitation, transparency, data security, and access to your own data), and renews this annually.
Certified companies are added to a public list where anyone can verify whether a provider is a member of the system.
Compliance with commitments is enforced by US authorities, primarily the Federal Trade Commission (FTC); violating companies may face fines and be removed from the list.
If you believe US intelligence agencies unlawfully accessed your data, you can file a complaint through the domestic data protection authority (in Hungary, the NAIH), which will ultimately be reviewed by a US body established for this purpose, the Data Protection Review Court.

An everyday example

Your workplace is introducing an American AI assistant that summarizes customer emails, meaning names and contact details are sent to American servers. The data protection officer then checks whether the provider appears on the framework list with valid certification. If yes, no separate contractual guarantees are needed for the data transfer itself, but the data processing agreement must still be concluded.

Who is affected

entrepreneur, executiveIf you use a US cloud or AI service with customer data, you must be able to demonstrate that the data is transferred to the United States lawfully.

developerWhen you integrate an American AI model or agent into an application, you must know where the users' data ends up and whether the provider is certified. → Code

lawyer, citizenThis system determines your rights and complaint options if your data is transferred to the United States. → Law

everyoneYou almost certainly use an American search engine, social platform, or chatbot that may transmit your data to the United States based on this framework.

A common misconception

MythSince the framework, European personal data can be freely sent to any American company.

In realityIt applies only to companies that have certified themselves and appear on the official list. Other GDPR obligations, such as legal basis, information provision, and data processing agreements, remain valid regardless.

Limits and risks

Its two predecessors, the Safe Harbor and the Privacy Shield, were invalidated by the Court of Justice of the European Union, leading many experts to consider this system vulnerable as well.
Intelligence safeguards are largely based on US presidential executive orders, which a later president can amend or revoke. Uncertainty increased when, in early 2025, several members of the independent US body overseeing intelligence (PCLOB) were removed and the board lost its quorum.
Companies self-certify without prior independent verification, and certifications can expire, so the list should be reviewed regularly.
It says nothing about whether an AI provider uses your data to train its model; you must check this in the service's own terms.

Similar, but not the same

General Data Protection Regulation (GDPR) – The GDPR is the EU's comprehensive data protection law; the framework is merely a tool that fulfills one GDPR requirement, the condition for cross-border data transfer to the USA.
Standard Contractual Clauses (SCC) – The SCC is a standard text issued by the European Commission for data transfers (not the everyday terms and conditions of companies). The two parties must conclude it with each other and support it with a risk assessment, but the framework applies to companies on the list without a separate contract.
Privacy Shield – The Privacy Shield was the earlier arrangement, invalidated in 2020; the current framework replaced it with stricter intelligence-gathering limits and a new redress body.

Related concepts

Broader

Data protection, General Data Protection Regulation (GDPR), International Data Transfer, Adequacy decision

Narrower

Data Protection Review Court, self-certification

On the edge

Standard Contractual Clauses (SCC), Privacy Shield, Data sovereignty, Cloud service, EU MI-rendelet (AI Act)

A brief history

The Court of Justice of the European Union invalidated the Safe Harbor system in 2015 and the Privacy Shield system in 2020, both times following complaints by Austrian lawyer Max Schrems (Schrems I and Schrems II rulings). In October 2022, the United States restricted intelligence access via an executive order; building on this, the European Commission adopted the adequacy decision on the framework on July 10, 2023.

Where things stand

The framework is in force, and thousands of US companies have joined it, including major cloud and AI providers. In September 2025, the EU General Court rejected the lawsuit seeking its annulment (the Latombe case), but the plaintiff appealed to the Court of Justice of the European Union, so its long-term fate remains uncertain.

Status: 2026 November

Also known as

EU–US Data Privacy Framework · EU–US Data Privacy Framework · EU-US Data Privacy Framework · DPF · EU–U.S. DPF · EU-US Data Privacy Framework · Data Privacy Framework · Trans-Atlantic Data Privacy Framework

Sources

Data Privacy Framework Program – official site of the US Department of Commerce and the list of certified companies

This entry was machine-edited and has undergone machine expert review; the “In the news” section updates automatically from Agent Age stories.