DEContact
Applies toEUDE

Data Privacy Framework (DPF)

EU-US adequacy decision since July 2023 — successor to the Privacy Shield

· Category: GDPR · Compliance-Kit

TL;DR

The EU-US Data Privacy Framework (DPF), in force since 10 July 2023 under Commission Decision (EU) 2023/1795, allows transfers of personal data to certified US companies without SCCs. It replaces the Privacy Shield, which was declared invalid by Schrems II. It was upheld by the General Court in judgment T-553/23 of September 2025 — the Schrems III action is pending before the Court of Justice of the EU.

What is the Data Privacy Framework (DPF)?

How the DPF works:

  1. The US company certifies itself with the US Department of Commerce
  2. Commitment to seven DPF principles (Notice, Choice, Accountability, Security, Data Integrity, Access, Recourse)
  3. The European Commission recognises the level of protection as 'adequate' (Art. 45 GDPR)
  4. EU data flows to DPF-certified companies are permitted without SCCs

Current list of certified companies: dataprivacyframework.gov. As at 04/2026: approx. 3,500 companies, including 95% of the relevant cloud providers (Microsoft, Google, Amazon, Salesforce, etc.).

Practical example

Practical effects:

  • Microsoft 365 (Microsoft Inc. DPF-certified): data transfer possible without SCCs
  • Mailchimp (Intuit Inc. DPF-certified): newsletter distribution simplified
  • Zoom: DPF-certified, but subject to sector-specific restrictions (public authorities and hospitals use other solutions)

Frequently asked questions

Do I still need SCCs if the DPF applies?
No, provided the US company is DPF-certified. In practice: a dual track (DPF plus SCCs) for stability in case of a Schrems III judgment.
How do I check a DPF certification?
The list is on dataprivacyframework.gov. Status 'Active' = currently certified. 'Inactive' = not certified, or no longer certified.
What happens in the event of Schrems III?
If the Court of Justice of the EU overturns the DPF (the General Court upheld it in T-553/23, but an appeal is possible): SCCs plus a TIA become mandatory again. Strategy: keep SCCs ready as a fallback safeguard.

See also

Practitioner note: This article is practice-oriented compliance documentation, not legal advice. We are compliance specialists, not a law firm. For legally binding advice, consult an admitted lawyer.