European Union. Data localisation / cross-border. Adequacy decision (Commission Implementing Decision)
EU–US DPFCommission Implementing Decision (EU) 2023/1795 on the adequate level of protection of personal data under the EU-US Data Privacy Framework
§1Summary
- Synopsis
Finds that US organisations self-certified to the Data Privacy Framework provide adequate protection, so personal data can flow to them from the EU without further transfer tools. It relies on US Executive Order 14086, which limits signals intelligence and created a redress mechanism including the Data Protection Review Court.
- Key themes
- Unique features
This is the third EU–US arrangement, after Safe Harbor and Privacy Shield, both struck down. It was upheld at first instance in Latombe, and a CJEU appeal plus a possible Schrems III challenge are pending.
- SaaS relevance
A US SaaS provider (or sub-processor) that self-certifies can receive EU data without SCCs; non-certified providers still need SCCs and a TIA.
§2Obligations
- Breach notification
- None
- DPO
- No
- Cross-border transfers
- Adequacy for DPF-certified US organisations
- Maximum penalty
- FTC/DoT enforcement under US law
§3Dates
- Key dates
- Adopted
- In force
- First periodic review in 2024. General Court dismissed the annulment action in Latombe v Commission (T-553/23) on 2025-09-03; appeal C-703/25 P lodged 2025-10-31 and pending at the CJEU as of Oct 2026.
§4Text and authority
- Text
- Authoritative text eur-lex.europa.eu
- Authority
- European Commission; US Department of Commerce (DPF list); FTC/DoT enforcement; Data Protection Review Court
§5Where it applies
§6Sources and verification
- Sources consulted
- Verification
High confidence.
There is a risk from PCLOB independence concerns raised in 2025. A UK Extension and the Swiss–US DPF exist separately.