Schrems II + DPF Update 2026: Status After Trump-2 Administration

1. DPF status 04/2026

The EU-US Data Privacy Framework (DPF) has been in force since 10 July 2023 (adequacy decision 2023/1795). It replaces the Privacy Shield, which was struck down in 2020. As at April 2026:

• 2,870 certified US companies (as at 03/2026, dataprivacyframework.gov)
• Annual recertification required
• EDPB Annual Report 03/2026: effectiveness "largely given, with room for improvement"
• European Parliament 11/2024: call for suspension — rejected by the European Commission

These status figures reflect the first version of 2 May 2026 and were not re-surveyed for the update of 16 August 2026; what was added is classification and implementation steps. Check your own provider's entry yourself before every decision.

What the status means for your documentation

The state of negotiations changes nothing about the documentation effort: every transfer to a Third Country belongs in the record of processing activities together with the safeguard relied upon. Art. 30(1) GDPR lists Third Country transfers together with documented safeguards as separate mandatory information; anyone who is themselves a Data Processor records the same information under Art. 30(2)(c) GDPR. A separate column per provider has proven effective: EU recipients are usually enough by name, Third Country recipients need the safeguard (DPF, SCCs or BCRs) spelled out beside them. Where this entry is missing for US tools, that is, in practical experience, a frequent finding in reviews of the record.

Practitioner recommendation (no statutory interval): attach the check of DPF certifications to the review of the record that is due anyway — annually plus on an ad hoc basis whenever something changes, and quarterly in fast-growing companies.

2. Trump executive order + DPRC risk

According to the first version of 2 May 2026 (not re-surveyed), Trump weakened the Data Protection Review Court with Executive Order 14149 of 20 January 2025:

• Appointment of new DPRC members without consultation
• Restriction of the mandate for "foreign intelligence" complaints

As at 2 May 2026: noyb (Max Schrems) has announced a Schrems III action but has not yet filed it. The DPF action brought by Latombe (T-553/23) was dismissed by the General Court on 3 September 2025 — the DPF formally continues to apply; Latombe lodged an appeal with the Court of Justice on 31 October 2025.

What to record from this

For Controllers, what follows from this situation is above all a documentation task: Accountability under Art. 5(2) GDPR requires you to be able to evidence your assessment — not merely that you made one. Record four lines per provider:

1. Date of the assessment and who carried it out
2. State of affairs relied upon (here: EO 14149, the Latombe decision, EDPB opinion 03/2026)
3. Outcome: continue to use, use with additional measures, or replace
4. Follow-up date — a practitioner recommendation, not a statutory deadline

That is the difference between a decision taken and evidence that stands up to review — filed where the review takes place (section 6).

3. Decision matrix for US providers

The matrix assigns a recommendation to each data class; what matters is the sensitivity of the data and whether the place of processing can be enforced contractually or technically.

Why the rows come out this way

Special Categories of Personal Data (Article 9). The processing of special categories — among others health data, genetic and biometric data for the purpose of unique identification, data concerning sex life, trade union membership — is prohibited under Art. 9(1) GDPR and permitted only via one of the narrow exceptions in Art. 9(2). If processing of such data on a large scale is involved, a data protection impact assessment must be carried out beforehand; Art. 35(3) GDPR names this case expressly. Hence the strictest row of the matrix.

HR data: Germany and Austria diverge. In Germany, practice bases employee data predominantly on § 26 BDSG. Austria has no dedicated employee data protection provision in the DSG; what governs there is Art. 6 and Art. 88 GDPR, supplemented by § 12(4) no. 2 DSG (image recordings for the purpose of monitoring employees are inadmissible) and § 96(1) no. 3 of the Austrian Labour Constitution Act (ArbVG) (monitoring measures that affect human dignity only with the works council's consent or a works agreement). Anyone rolling out an HR solution in both countries therefore needs two review paths.

Irrespective of provider and transfer route, every processing operation needs a legal basis under Art. 6(1) GDPR: consent, contract, legal obligation, vital interests, public interest or legitimate interest.

4. SCCs 2021/914 + TIA

If a US provider is NOT DPF-certified: standard contractual clauses 2021/914 + a transfer impact assessment (TIA). The contract governs the obligations; the TIA assesses access exposure, protective measures and residual risk along the seven points below.

Minimum content of a TIA:

1. Categories of data + categories of recipients
2. Access by US authorities? (FISA 702, EO 12333, CLOUD Act)
3. Is the data category a special category?
4. Encryption at rest + in transit?
5. Keys held by the Controller or the provider?
6. Additional technical/contractual measures
7. Residual risk assessment

Where the results belong

A TIA that exists only as a standalone file will not be found in an audit. Three results belong in existing documents; the residual risk assessment itself remains part of the Accountability documentation (review point 5 in section 6):

Practitioner rhythm (no statutory deadline): a TIA is not a one-off document. It has proven effective to take it up together with the review of the record — annually, plus on an ad hoc basis when the provider changes sub-processors, the place of processing or the encryption architecture.

5. EU alternatives list 2026

The list assigns EU alternatives with their country of establishment and a typical migration duration to the most common US tools. Tool and duration details are editorial values from experience, as at the first version of 2 May 2026, and were not re-surveyed.

What has to move along with a migration

A change of provider is only complete once the documentation has been brought up to date. Four points are regularly left undone:

1. Remove the old recipient. Outdated recipient lists — the replaced newsletter tool still sitting in the record — are, in practical experience, among the frequent errors in the record.
2. Conclude a new data processing agreement. Art. 28(1) and (3) GDPR applies to EU providers as well: only Data Processors providing sufficient guarantees, and a contract with the statutory minimum content.
3. Update the Third Country column. If the transfer ceases, the safeguard entry ceases with it. Practitioner recommendation: version the change with a date — supervisory enquiries target currency and traceability.
4. Bring the Privacy notice up to date. The information obligations follow directly from Art. 13 and Art. 14 GDPR; in Austria, the Data Protection Authority is to be named as the complaints body (Art. 13(2)(d) GDPR).

6. Third Country audit checklist

Eight points with which you can review the Third Country part of your documentation in a single pass. Point 1 deliberately comes first: in practice, supervisory enquiries typically begin with the production of the record of processing activities; the data processing agreement, the TOM concept and the impact assessment follow (practical experience, not a supervisory rule).

1. Which US providers do I have? (extract from the record)
2. Per provider: is the DPF certification valid?
3. Are the categories of data special categories?
4. Are the SCCs 2021/914 anchored in the data processing agreement?
5. Is the TIA documented?
6. Third Country notice in the Privacy notice (Art. 13(1)(f))?
7. Is an EU alternative scenario prepared?
8. Contingency plan: what if the DPF is struck down?

Why every point counts

Germany and Austria: who supervises, what applies in addition

The substantive standard of the GDPR is the same in both countries; what differs is the supervision and the national overlay.