What is the EU-US Data Privacy Framework?
The EU-US Data Privacy Framework is a European Commission decision that allows personal data to be transferred to US organisations that have signed up to it.
The decision, (EU) 2023/1795, was adopted on 10 July 2023. It rests on a US executive order from 2022 that requires intelligence gathering to be necessary and proportionate, and that sets up a court for complaints.
On 3 September 2025 the EU General Court dismissed an action to annul the framework, in Case T-553/23. The judgment was appealed on 31 October 2025, and Case C-703/25 P is pending.
The framework covers personal data and organisations that have signed up. Other transfers can rely on standard contractual clauses instead, which often need to be backed by an assessment of the destination country's laws.
How it works
A US organisation signs up by committing to follow the framework's principles. Transfers to it then need no further safeguards. Protection against intelligence gathering rests on the executive order and on the right to complain to the special court. Which organisations have signed up is shown on a public list kept by the US Department of Commerce.
Why it matters
The framework makes it easier for many organisations to use US services. It is the third of its kind, after two that were struck down, most recently in Schrems II. That is why the court case is followed closely.
What to keep in mind
The framework governs how intelligence gathering is limited and reviewed. The possibility of demanding data under the CLOUD Act remains.
The framework covers personal data. Trade secrets and other confidential information need to be assessed under other rules.
What it means for you
Ask the supplier whether it has signed up to the framework, and make a plan for what you would do if it fell.
Common questions
Does the framework apply today?
Yes. The General Court dismissed a challenge to it in September 2025. The appeal is pending before the Court of Justice, with no date set for a ruling.
What happens if the framework falls?
Transfers then need another basis, such as standard contractual clauses with an assessment of US law. An alternative is to have the data processed within the EU.
Sources: Commission Decision (EU) 2023/1795 on EUR-LexGeneral Court judgment in Case T-553/23 on EUR-Lex
Related terms
Read more
All terms Updated