Sovereignty · Updated 10 November 2026 · 8 min read

EU-US Data Privacy Framework: can you rely on it in 2026?

How the 2023 adequacy decision works, what the 2025 court ruling settled, what the pending appeal puts at risk and how to keep a fallback ready.

View as Markdown

The EU-US Data Privacy Framework, or DPF, lets you send personal data from the EEA to a US company without extra safeguards, as long as that company has self-certified under it and the certification covers your data. You can rely on it today: the European Commission adopted it on 10 July 2023 and the EU General Court upheld it on 3 September 2025. But an appeal is pending before the Court of Justice, the same court that struck down the two frameworks before it, so treat the DPF as valid now and plan for the day it might not be.

This page explains the rules and isn't legal advice. For who can be ordered to hand data over, a separate question from transfers, read EU region vs EU company.

Your transfer options at a glance

Route	Legal basis	What you do	If the DPF falls
Data Privacy Framework	Commission adequacy decision of 10 July 2023	Check the recipient on the DPF List and sign a processing agreement if it's your processor	Transfers on this basis lose their footing
Standard contractual clauses	Article 46(2)(c) GDPR	Sign the Commission's clauses with the US recipient and document a transfer impact assessment	A separate basis that doesn't depend on the adequacy decision
Binding corporate rules	Article 47 GDPR	Approved group rules, for transfers inside one corporate group	A separate basis
Keep personal data in the EEA	No transfer under Chapter V	Pick providers and suppliers that stay in Europe, including for remote access	Nothing to replace

What the framework is

The EDPB describes the DPF as a self-certification mechanism for companies in the US. A company joins by committing to the DPF Principles, which are rules on how it handles personal data of people in the EEA. The Commission then found that transfers to certified companies get an adequate level of protection, so data can move to them without further safeguards or an authorisation.

Not every US company can join. It must fall under the investigatory and enforcement powers of the Federal Trade Commission or the Department of Transportation. According to the EDPB, that leaves out, for example, banks, insurers, many non-profits and telecom carriers for their common carrier activities.

The framework covers any kind of personal data, including health data and employee records, but only if the company's certification includes that category. Certifications that cover customer data don't always cover HR data.

Why it might not last

Two earlier frameworks for EU-US transfers were declared invalid by the Court of Justice: Safe Harbor in the Schrems I judgment of 6 October 2015, and Privacy Shield in Schrems II on 16 July 2020. Both times the court found that US law didn't protect Europeans' data at a level essentially equivalent to EU law.

The US answered Schrems II with Executive Order 14086 of 7 October 2022, which added safeguards for intelligence activities, and an Attorney General regulation that set up a Data Protection Review Court for complaints from Europeans. The Commission built the DPF on those two texts.

A French member of parliament, Philippe Latombe, asked the EU General Court to annul the decision. He argued that the review court depends on the executive and that bulk collection of data without prior authorisation by a court or an independent authority is unlawful. On 3 September 2025 the General Court dismissed the case in full. Two details in the ruling matter for you:

It judged the situation on the day of adoption. The court confirmed that the US ensured adequate protection on 10 July 2023. It didn't rule on later changes.
The Commission keeps watching. It must monitor the US legal framework continuously and may suspend, amend or repeal the decision if that framework changes.

Latombe appealed to the Court of Justice on 31 October 2025. Until that court rules, the General Court's judgment stands and the adequacy decision stays in force.

What to check before you rely on it

The recipient is on the DPF List. The US Department of Commerce publishes it. A certification must be renewed every year, and companies that drop off appear in a separate register of inactive participants. You can't rely on the DPF for those.
The certification covers your data. Look for HR or non-HR data, whichever you send, and check that a US subsidiary is covered by its parent's certification before you assume it is.
You still have a processing agreement. If the US company processes data for you, Article 28 GDPR requires a written agreement whether or not it's certified.
The rest of the GDPR still applies. The DPF only answers the transfer question. You still need a legal basis for the processing, and your privacy notice should name the recipients and say the transfer relies on the DPF.
Every supplier in the chain. A European app can send data to the US through its email, analytics, error tracking or code hosting. Each of those needs its own basis.

A fallback plan

The EDPB puts the duty on you: data exporters must keep track of whether the adequacy decisions they use are still in force. A short plan avoids a scramble if the Court of Justice rules against the framework.

List every US recipient of personal data and the basis each one uses today.
For each DPF-only recipient, find out whether it also offers standard contractual clauses in its processing agreement.
Mark the services you could move to a European provider with little effort, such as static hosting or transactional email.
Watch the appeal on the Court of Justice's case register and the Commission's reviews of the decision.

Moving data back to Europe removes the transfer question for those services. It doesn't by itself settle who controls the provider, which is what data residency vs data sovereignty covers.

Where Eurobase fits

Eurobase is a business registered in Warsaw, Poland, and hosts your apps on European infrastructure run by Scaleway, a French provider. Your app, its files and its logs stay on that infrastructure, so hosting itself doesn't need the DPF.

Two US subprocessors appear only if you connect them: GitHub, Inc. and GitLab Inc., for repository access and deploy triggers. The Eurobase subprocessor list records that those transfers use each provider's contractual transfer safeguards. If you'd rather keep code in Europe, you can deploy from Codeberg, run by a German association. Paid plans go through Stripe Payments Europe in Ireland, and the list notes that Stripe group services apply Stripe's contractual transfer safeguards.

Eurobase doesn't hold ISO 27001 or SOC 2 yet; work on both is under way. It also doesn't offer managed Postgres, MySQL or Redis, so a database elsewhere is part of your own transfer list. The GDPR hosting checklist covers what else to ask any host, and the data processing agreement is public.

Frequently asked questions

Is the EU-US Data Privacy Framework still valid in 2026?

Yes. The adequacy decision of 10 July 2023 is in force, and the General Court rejected the annulment action against it on 3 September 2025. An appeal filed on 31 October 2025 is pending before the Court of Justice, so check its status before you make long-term plans.

How do I check if a US company is certified under the DPF?

Search for the company on the Data Privacy Framework List on dataprivacyframework.gov. Confirm that its status is active, that it covers the data type you send, and, for a subsidiary, that the parent's certification names it.

Do I still need standard contractual clauses if a provider is DPF certified?

Not for the transfer itself: an active, relevant certification is enough under Chapter V. You still need a data processing agreement if the provider is your processor. Having clauses ready as well means a court ruling doesn't leave you without a basis.

What happens to my data transfers if the Court of Justice strikes the framework down?

Transfers that rely only on the DPF would need another basis, such as standard contractual clauses or binding corporate rules, or would have to stop. That's why it pays to know today which of your suppliers can switch to clauses.

Does the DPF protect my data from US government access?

Only in part. It sets rules for certified companies, and the US safeguards behind it limit intelligence access and give Europeans a route to the Data Protection Review Court, but US agencies can still collect data under the conditions of US law. Whether a provider can be ordered to hand data over is a separate question, covered in EU region vs EU company.