EU-US Data Privacy Framework (DPF)

What is the EU-US Data Privacy Framework?

The EU-US Data Privacy Framework, or DPF, is a program that lets companies in the EU send personal data to certified US companies without signing extra contracts. US companies join by promising to follow a set of privacy principles.

Legally, it rests on an adequacy decision: a European Commission finding that certified US companies protect EU data well enough. The Commission adopted it on July 10, 2023. It replaced Privacy Shield, which the EU's top court struck down in 2020.

A few rules shape who can join, per the DPF Principles:

• Only US companies under the jurisdiction of the Federal Trade Commission or the Department of Transportation can take part.
• Companies self-certify with the US Department of Commerce and must recertify every year.
• Participation is voluntary, and the FTC can act against companies that falsely claim to take part.

Status as of October 2026

The DPF is valid. On September 3, 2025, the EU General Court dismissed a challenge to it in Latombe v Commission (Case T-553/23). The challenger appealed to the Court of Justice on October 31, 2025, as Case C-703/25 P. As of October 2026, that appeal is pending. Until the Court of Justice rules otherwise, the framework stays in force.

What it looks like in a vendor's terms

A typical clause reads like this:

Provider is certified under the EU-US Data Privacy Framework, the UK Extension and the Swiss-US Data Privacy Framework, and will maintain its certification. If the Data Privacy Framework is invalidated, the Standard Contractual Clauses will apply to any transfer.

• "Certified under": a claim you can check on the public DPF list.
• "Will maintain its certification": a promise to recertify each year. Without it, the vendor could let it lapse.
• "If... invalidated": a fallback. If a court strikes the framework down, the standard contractual clauses take over.

ActiveCampaign's DPF page is a real example. It says the company "complies with the EU-U.S. Data Privacy Framework" and also lists the UK and Swiss parts.

Why it matters to you

If you have EU users or customers, many of your US vendors may rely on the DPF for those transfers. That makes your setup depend on a decision that a court may still review.

A lapsed certification is a quieter risk. If a vendor drops off the list and its DPA has no fallback, your transfers to it may lose their legal basis. Your EU customers may also ask you to name the transfer route for each vendor.

UK transfers follow their own track. The ICO says the UK Extension rests on separate UK regulations and would not automatically fall if the EU framework were struck down.

What to check

To check a vendor, follow these steps:

1. Find the vendor's DPF statement, often in its privacy policy or trust center.
2. Search the official DPF list, which the UK government links to, for the exact company name.
3. Confirm the status is active, not inactive.
4. Confirm it covers the right data (HR, non-HR or both) and, if needed, the UK and Swiss parts. The ICO lists these checks for UK transfers.
5. Check that the vendor's DPA keeps SCCs as a fallback.
6. Repeat the check from time to time. Morgan Lewis gives every six months as an example.

Swiss-US Data Privacy Framework

Switzerland is not in the EU, so it has its own version. The Swiss-US Data Privacy Framework lets Swiss companies send personal data to certified US companies without extra contracts.

On August 14, 2024, the Swiss Federal Council added the US to its list of countries with adequate protection, but only for companies certified under the Swiss-US framework. The change took effect on September 15, 2024.

According to Walder Wyss, a Swiss law firm, transfers under the framework need neither standard contractual clauses nor a transfer impact assessment. The firm also suggests that exporters require the US recipient, in the contract, to keep its certification.

A US vendor joins this framework separately. ActiveCampaign's DPF page, for instance, lists September 15, 2024 as the date the Swiss part took effect. When you check a vendor on the DPF list, confirm the Swiss part is included if you send data from Switzerland.

Schrems II

Read the full page on Schrems II

Schrems II is the July 16, 2020 ruling of the EU Court of Justice (Case C-311/18) that struck down Privacy Shield.

As the court's press release summarized, it found two problems with US law:

• US surveillance programs were not limited to what is strictly necessary.
• EU individuals had no effective way to challenge that access before an independent body.

The court kept standard contractual clauses valid, with a catch. Companies using them must check, case by case, whether the destination country's laws let the importer keep its promises. That check became the transfer impact assessment. The court also confirmed that data protection authorities can suspend or ban transfers where the clauses cannot be honored.

The DPF is the EU and US answer to this ruling. The pending Latombe appeal tests whether it holds.

How Venpo helps

Venpo monitors your vendors' privacy policies, DPAs and subprocessor lists and emails you when their transfer wording changes, such as a dropped DPF reference or a removed SCC fallback. Each vendor's change history shows how its transfer terms moved over time.