EU-US Data Privacy Framework: is it safe to use US tools?
Hephaestus Technology7 min read
Yes, for now: the EU-US Data Privacy Framework is still a valid legal basis for sending personal data to certified US companies, and the EU General Court upheld it in September 2025. But two live risks hang over it as of November 2026, an appeal pending at the Court of Justice and a US Supreme Court ruling that removed job protection for FTC commissioners, which the European Data Protection Board has asked the Commission to assess. EU businesses can keep using certified US tools, but should keep a fallback ready.
Key takeaways
- The EU-US Data Privacy Framework rests on Commission Implementing Decision (EU) 2023/1795 of 10 July 2023 and remains in force until the Commission withdraws it or a court annuls it.
- The General Court dismissed the Latombe challenge on 3 September 2025; the appeal, Case C-703/25 P, was lodged on 31 October 2025 and is still pending.
- On 31 July 2026 the EDPB asked the Commission to assess whether the US Supreme Court's Trump v. Slaughter ruling on FTC independence affects the framework.
- Only US companies on the Department of Commerce's Data Privacy Framework List are covered; for everyone else you need standard contractual clauses or another Chapter V tool.
- The prudent approach is to map US transfers, check certifications, keep SCCs in vendor contracts and know how you would switch if the framework fell.
What is the EU-US Data Privacy Framework?
The EU-US Data Privacy Framework (DPF) is an adequacy arrangement that lets personal data flow from the EU to participating US organisations without extra transfer safeguards. Legally, it is Commission Implementing Decision (EU) 2023/1795, adopted on 10 July 2023 under Article 45 of the GDPR. Article 1 of that decision says the US ensures an adequate level of protection for data transferred to organisations "included in the Data Privacy Framework List" maintained by the US Department of Commerce.
It is the third attempt. The Court of Justice struck down Safe Harbour in Schrems I (2015) and Privacy Shield in Schrems II (2020), as the Court's press release on the Latombe case recalls. The DPF was built on a US Executive Order of 7 October 2022 that added safeguards for intelligence activities and created the Data Protection Review Court (DPRC) for EU complaints.
What changed in 2025 and 2026?
Three developments define where the framework stands today.
| Date | Development | Source |
|---|---|---|
| 3 September 2025 | General Court dismisses Philippe Latombe's action to annul the DPF (Case T-553/23) | CJEU press release 106/25 |
| 31 October 2025 | Latombe appeals to the Court of Justice (Case C-703/25 P) | Official Journal notice |
| 29 June 2026 | US Supreme Court decides Trump v. Slaughter, overruling Humphrey's Executor on removal of FTC commissioners | EDPB letter |
| 31 July 2026 | EDPB asks the Commission to assess whether this affects the DPF | EDPB letter |
The General Court ruling. The court rejected both of Latombe's arguments. It found that DPRC judges have safeguards for their independence and can be dismissed only by the Attorney General for cause. On bulk collection by US intelligence agencies, it held that Schrems II requires at least ex post judicial review, not necessarily prior authorisation, and that DPRC oversight meets that bar. It also noted that the Commission must monitor US law continuously and can suspend, amend or repeal the decision if that law changes.
The appeal. An appeal to the Court of Justice is limited to points of law. When we checked EUR-Lex for this article, we found the appeal notice but no judgment or Advocate General opinion. Court of Justice appeals typically take more than a year, so a ruling may not arrive before 2027, but that is an estimate, not a published date.
The FTC ruling. The adequacy decision relies partly on the FTC as an independent enforcer of the DPF Principles. In its letter of 31 July 2026, the EDPB noted that the decision refers to FTC commissioners being removable only for "inefficiency, neglect of duty, or malfeasance in office", a protection the Supreme Court's ruling removed. The EDPB asked the Commission "to closely assess whether this development affects the functioning" of the decision. We could not find a published Commission assessment as of 8 November 2026.
Is it still legal to use US tools such as cloud, CRM or AI APIs?
Yes, if the US provider is on the DPF List, or if you use another valid transfer tool. Nothing in the developments above has suspended the adequacy decision. The decision stays in place unless the Commission, which must monitor US law continuously under Article 3, decides to suspend, amend or repeal it, or the Court of Justice annuls it.
If a provider is not DPF-certified, Chapter V of the GDPR still allows transfers using appropriate safeguards, most commonly the standard contractual clauses adopted in Commission Implementing Decision (EU) 2021/914. Many large US cloud and SaaS vendors include SCCs in their data processing terms as well as relying on the DPF, which gives you a ready-made fallback.
The risk is not illegality today. It is the disruption if the framework were struck down, as happened overnight with Privacy Shield in 2020.
Who is most affected?
The businesses most exposed are those whose product depends on US processors with no fallback. That includes:
- SaaS startups hosting customer data with US hyperscalers or using US sub-processors for email, analytics, support and AI.
- AI product teams sending prompts containing personal data to US model APIs; see our guide to using customer data in LLM features under GDPR.
- SMEs using US marketing and CRM tools where transfers are part of every campaign.
- B2B suppliers whose enterprise customers ask pointed questions about transfers in procurement.
Companies that already host personal data in the EU, with US vendors limited to support access under SCCs, are less exposed. Our comparison of EU cloud vs US cloud for data residency looks at that choice in detail.
What should EU businesses do now?
Prepare, do not panic. Five practical steps:
- Map your US transfers. List every vendor that stores or accesses personal data from the US, including sub-processors.
- Check DPF certification. Confirm each US vendor appears as active on the Department of Commerce's Data Privacy Framework List, and that its certification covers the kind of data you send.
- Confirm SCCs are in place as a fallback. Check that vendor DPAs incorporate the 2021 SCCs so you are not left without a transfer tool if the DPF fails.
- Keep transfer impact assessments current for transfers relying on SCCs, and note any changes in US law you have relied on.
- Know your exit options. Identify EU-hosted alternatives or EU-region settings for critical vendors, so you could move in months, not years.
Record these decisions alongside your records of processing. If you are building a product from scratch, our GDPR checklist for a new SaaS product shows where transfers fit. This is general information, not legal advice; for large or sensitive transfer volumes, take specialist advice.
Frequently asked questions
Is the EU-US Data Privacy Framework still valid in November 2026?
Yes. Commission Implementing Decision (EU) 2023/1795 remains in force. The General Court upheld it in September 2025, and neither the pending appeal nor the EDPB's July 2026 request has suspended it.
What is the Latombe case?
Philippe Latombe, a French citizen, asked the General Court to annul the DPF, arguing the Data Protection Review Court is not independent and US bulk collection is not properly limited. The court dismissed the action on 3 September 2025, and he appealed to the Court of Justice on 31 October 2025 in Case C-703/25 P.
Why does the Trump v. Slaughter ruling matter for GDPR?
The adequacy decision relies on independent US oversight, including the FTC's enforcement of the DPF Principles. The Supreme Court ruled on 29 June 2026 that the President can remove FTC commissioners without the previous for-cause limits, and the EDPB has asked the Commission to assess whether that affects the framework.
What happens to my data transfers if the framework is struck down?
Transfers relying only on the DPF would lose their legal basis. You would need another Chapter V tool, usually the standard contractual clauses plus a transfer impact assessment, or move processing to the EU. Having SCCs already in vendor contracts shortens that transition considerably.
Do I need to stop using US cloud providers?
No. Using US providers that are DPF-certified or that sign SCCs remains lawful. Many businesses reduce risk further by choosing EU data regions and limiting what personal data leaves the EU.
If you want help mapping your US transfers or planning an EU-hosted fallback, book a free 30-minute call.
Cover photo by Kampus Production on Pexels.