SCCs vs Data Privacy Framework

The short answer

Under GDPR, personal data can leave the EU only under certain conditions (Article 44). SCCs meet those conditions through a contract. The DPF meets them through an EU adequacy decision: a finding that US companies certified under the program protect EU data well enough.

A vendor can rely on both at once, with SCCs kept as a backup in case the DPF falls.

SCCs

• What they are: model contract clauses the European Commission has "pre-approved." The current set was issued on 4 June 2021 (European Commission).
• Legal basis: GDPR Article 46(2)(c) lists "standard data protection clauses adopted by the Commission" as a valid safeguard.
• Who they bind: the two companies that sign them, for example you and your vendor. They usually sit inside or next to the DPA.
• Where they work: any country, not just the US.
• Extra work: a transfer under SCCs still needs a transfer impact assessment, a written review of whether the destination country's laws undercut the clauses. Baker McKenzie notes these assessments are still required for US transfers, but the EU's findings on US law behind the DPF make them simpler.

Data Privacy Framework

• What it is: an EU adequacy decision for the US companies that join the program. Under GDPR Article 45, a transfer based on an adequacy decision "shall not require any specific authorisation."
• Who it binds: the US company that self-certifies. The Department of Commerce says companies publicly commit to the DPF Principles, which are enforceable under US law.
• History: it took over from the older Privacy Shield program. When the DPF launched, the Department of Commerce told Privacy Shield members to self-certify to the DPF.
• Where it works: only for transfers to US companies that have self-certified and are active participants. It does not cover transfers to other countries.
• Legal status, as of October 2026: the DPF is valid. The EU General Court upheld it on September 3, 2025 in Latombe v Commission, case T-553/23 (judgment). Mr. Latombe appealed to the Court of Justice on October 31, 2025, as case C-703/25 P (Official Journal notice), and that appeal is still pending.

Which one applies to you

If you send EU personal data to a US vendor, check which route its DPA names. Some name both.

The Atlassian DPA is one example. It says the EU SCCs "are hereby incorporated into this DPA by reference," and also that Atlassian "participates in and certifies compliance with the Data Privacy Framework."

Why vendors switch between them, or keep both:

• Adding the DPF: it is a single certification that covers all EU customers, with less paperwork per transfer.
• Keeping SCCs: the DPF is under court review, and law firms such as WilmerHale recommend "maintaining alternative transfer mechanisms, such as standard contractual clauses."
• Subprocessors: a vendor on the DPF may still send data to its own subprocessors in other countries, which needs SCCs or another route.

Example

For example, imagine your US email tool's DPA used to rely only on SCCs. An update now relies on the DPF and moves the SCCs to a fallback clause. Nothing changes for you day to day. But if the Court of Justice strikes down the DPF, the SCCs in that fallback clause are what the transfer would rely on, so you want them to stay in the DPA.

The opposite change matters more, because it removes your backup. If a vendor's DPA drops the SCCs and relies only on the DPF, check that the vendor appears as active on the official DPF List and that its listing covers the data you send. If it does not, ask the vendor to restore the SCCs or explain which route now covers the transfer.

How Venpo helps

Venpo monitors your vendors' DPAs, privacy policies and subprocessor lists, and emails you a plain-English alert when the wording changes, including when a vendor adds or drops a transfer mechanism. Each vendor's change history shows what the DPA said before.