EU-US Data Privacy Framework Adequacy Decision Adopted
The European Commission adopted an adequacy decision for the EU-US Data Privacy Framework (DPF), restoring a legal mechanism for transferring personal data from the EU to certified US organizations. The framework introduced new safeguards including binding limitations on US intelligence access to EU data, a Data Protection Review Court, and enhanced oversight mechanisms. US organizations must self-certify through the Department of Commerce to rely on the DPF as a transfer mechanism.
Key Analytics
Impact Analysis
The DPF provides a streamlined transfer mechanism that eliminates the need for SCCs or supplementary measures when transferring data to DPF-certified US organizations. The framework survived its first legal test on September 3, 2025, when the EU General Court dismissed the Latombe annulment action (Case T-553/23) and confirmed the validity of the adequacy decision. Latombe appealed to the Court of Justice on October 31, 2025, and that appeal remains pending, so organizations should keep contingency transfer mechanisms in place until final resolution. Companies receiving data under the DPF must comply with its principles and are subject to enforcement by the FTC or DOT.
Recommended Actions
- Determine whether your US data recipients are DPF-certified and update data transfer agreements and records of processing accordingly.
- Maintain Standard Contractual Clauses and supplementary measures as a fallback transfer mechanism while the Latombe appeal remains pending before the Court of Justice.
- If your organization is US-based and receives EU personal data, evaluate the benefits and obligations of DPF self-certification through the Department of Commerce.
Always verify requirements with official regulatory sources.
Estimated Remediation Effort
Indicative effort to address this development, broken down by your organization's current compliance posture. Select the posture that best matches where you are today.
A partial program exists: some policies and controls are in place, but coverage, evidence, and ownership have gaps.
- ›DPF certification status verification for US recipients
- ›SCC and supplementary measure fallback maintenance
- ›Transfer agreement and records of processing updates
The Cost of Waiting
Readiness work is dramatically cheaper before a deadline than after one. The ranges below come from the same estimate: the difference is only how prepared you are when the work starts.
Roughly 85 to 185 hours avoided by preparing early
Effort ranges are indicative planning estimates, not quotes. Actual effort depends on organizational scope, environment complexity, and evidence maturity. Talk to us for a scoped assessment.