Is the EU-US Data Privacy Framework enough?

The EU-US Data Privacy Framework is currently the simplest route for transferring personal data to the United States. It rests on the US limits on intelligence gathering described in FISA 702 and what intelligence laws mean for the cloud, and it is a central part of the picture on US law and data stored in Europe.

What the framework does

Since 10 July 2023 a European Commission decision has recognised that the United States provides adequate protection for personal data transferred to organisations that have signed up to the EU-US Data Privacy Framework. A third-country transfer to such an organisation needs no further safeguards. This has simplified work for many organisations, and the framework reflects long efforts on both sides.

The framework rests on Executive Order 14086 from 2022, which requires US intelligence gathering to be necessary and proportionate. The order also set up a court for complaints, the Data Protection Review Court, open to people in the EU.

What is being tested

This is the third framework of its kind. The EU Court of Justice struck down both of its predecessors, most recently in the Schrems II ruling in 2020, and the new one was designed to meet the court’s objections.

On 3 September 2025 the EU General Court dismissed an action for annulment of the framework in Case T-553/23, finding that the United States provided adequate protection when the decision was adopted. The judgment was appealed on 31 October 2025 and is pending before the Court of Justice as Case C-703/25 P. No date has been set for a ruling.

Questions have also been raised about oversight in the United States. In January 2025 members of the US board that reviews privacy protection in intelligence work were removed. The Commission told the European Parliament that the executive order remains in force and that it is monitoring developments.

Where the framework stops

The framework covers personal data transferred to organisations that have signed up. Confidential information in general falls outside it, as does information that contains no personal data, such as trade secrets. It governs how US intelligence gathering is limited and reviewed, but authorities can still demand data under the CLOUD Act or 702.

Transfers outside the framework can use standard contractual clauses. Since Schrems II these often need to be backed by an assessment of the destination country’s laws and, where necessary, additional measures. The European Data Protection Board has issued recommendations on how to carry this out.

A plan for either outcome

A framework in force is a sound basis. But because it is being challenged, you should know what you would do if it fell. Identify which services transfer personal data to the United States and the legal basis for each transfer. Ask suppliers whether they have signed up to the framework and how they would respond if the decision were annulled. Decide which data would then need to move, and where to.

A contract that makes it easy to take your data with you helps, as described in what happens to your data when the contract ends. A plan B can also be a setup in which the data is never transferred, such as AI that runs in Sweden or on your premises. The Swedish rules for public bodies follow in cloud services and confidentiality in the public sector.

How it works in iSearch

iSearch can run on your premises, with the whole chain in your own environment and no public AI services. Hosted by us, it runs in Sweden, by a Swedish company with no US owners and no US-owned sub-suppliers for the hosting, in a separate environment for each customer.

Both on your premises and hosted by us, iSearch can run entirely without public AI services, with the language model in Sweden or in your own environment. No data is then transferred to the United States, and the question of the framework does not arise for it.

If you choose to use public AI services, the transfer of the data sent there rests on the framework or on standard contractual clauses. If those conditions change, only that part is affected, and you can carry on without public AI services. Read more about GDPR and AI or book a walkthrough.