Regulationsby GlyphEU-US Data Privacy Framework
In force European Union · In force Jul 10, 2023 · no upcoming deadlines
Deadlines
Latombe appeal lodged at the Court of JusticeLatombe appealed the General Court judgment to the Court of Justice on points of law (reported as Case C-703/25 P); the DPF stays valid while it is pending.
General Court upholds DPF (Latombe v Commission)General Court dismissed Philippe Latombe's action for annulment (Case T-553/23) and confirmed the US offered adequate protection when the decision was adopted.
DPF adequacy decision adopted and effectiveCommission adopted Implementing Decision (EU) 2023/1795, effective on notification to Member States; EU-US transfers to DPF-certified organisations may proceed without additional safeguards.
Summaries for reference, not legal advice. Check the official text.
What it does
GDPR Art 45 adequacy decision letting personal data flow from the EEA to US organisations self-certified under the Data Privacy Framework with the US Department of Commerce, with no further transfer mechanism needed. It relies on US Executive Order 14086 safeguards and the Data Protection Review Court for redress. The EU General Court upheld it in Latombe v Commission (T-553/23) on 3 Sep 2025, and an appeal is pending before the Court of Justice.
- Who it applies to
- EEA exporters transferring personal data to US organisations on the DPF List (self-certified, under FTC or DOT jurisdiction). Transfers to non-certified US recipients still need SCCs/BCRs, which benefit from the same US safeguards.
- Penalties
- No standalone fines; unlawful transfers fall under GDPR Art 83(5) (up to EUR 20M or 4% of worldwide turnover). US certified organisations face FTC/DOT enforcement.
- Enforced by
- European Commission (monitoring, periodic review); EU data protection authorities; US Department of Commerce, FTC and DOT
- Official name
- Commission Implementing Decision (EU) 2023/1795 on the adequate level of protection of personal data under the EU-US Data Privacy Framework
- Citation
- OJ L 231, 20.9.2023, p. 118 (notified under document C(2023)4745)
- Topics
- Privacy, Data residency
Research notes
Art 3(4) required a first review one year after notification. The Commission completed the first periodic review in October 2024 (exact date not re-verified here), with the next review expected after about three years. Appeal case number C-703/25 P and the 31 Oct 2025 lodging date come from secondary sources, not CURIA directly. No CJEU hearing or judgment was found as of the research date. The decision's validity also depends on US safeguards (EO 14086, PCLOB functioning), which the Commission monitors.
Related
Cyber Resilience ActSets mandatory cybersecurity requirements for hardware and software products with digital elements sold in the EU: secure by design, vulnerability handling, security updates for the support period, SBOMs, and CE marking after conformity assessment. Manufacturers must report actively exploited vulnerabilities and severe incidents to CSIRTs and ENISA from 11 Sep 2026.Next: Dec 11, 2027 CRA fully applies · in 13 monthsDORAHarmonised ICT risk-management, major ICT-incident reporting, digital operational resilience testing (including threat-led penetration testing) and ICT third-party risk rules for EU financial entities. Financial entities must keep a register of all ICT third-party contracts. Critical ICT third-party providers (cloud, data centres and similar) come under direct EU oversight.In effect since Jan 16, 2023Data Governance ActSets conditions for re-use of protected public-sector data (personal data, trade secrets, IP) and creates a notification and neutrality regime for data intermediation services. It also sets up voluntary registration of 'recognised data altruism organisations'. Data intermediaries must stay neutral, separate the intermediation service from other services and notify a competent authority.In effect since Jun 23, 2022Digital Markets ActImposes ex-ante do's and don'ts on designated gatekeepers. Examples: no combining personal data across services without consent, no self-preferencing, interoperability, data portability, and business-user data access. Gatekeepers must notify all acquisitions and submit an audited description of consumer profiling techniques.In effect since Nov 1, 2022Digital Omnibus (data/GDPR)Commission proposal to simplify EU digital rules. It would amend the GDPR (personal data definition, processing for AI, a new cookie/terminal-equipment consent regime in Art 88a/88b, breach notification only for high-risk breaches within 96 hours) and the ePrivacy Directive, NIS2, CER Directive and Data Act. A single-entry point would handle incident reporting, and the Data Governance Act, Free Flow Regulation, Platform-to-Business Regulation and Open Data Directive would be repealed and merged into the Data Act. The AI Act part was split out and adopted separately as Regulation (EU) 2026/1744.No date setDigital Services ActLayered obligations for intermediary services: notice-and-action for illegal content, statements of reasons, complaint handling, transparency reporting, and ad and recommender transparency. Profiling-based ads to minors and ads based on sensitive data are banned. Very large online platforms and search engines (45M+ EU users) must also run annual systemic-risk assessments and audits and give researchers data access.Next: Feb 18, 2027 DSA SME impact report · in 4 monthsEU AI ActA risk-based product-safety regime for AI. It bans certain AI practices, imposes strict requirements on high-risk AI systems (risk management, data governance, documentation, human oversight, conformity assessment), sets transparency duties for chatbots, deepfakes and AI-generated content, and sets obligations for general-purpose AI model providers. The Digital Omnibus on AI (Regulation (EU) 2026/1744, in force 27 July 2026) pushed the high-risk dates back to 2 December 2027 (Annex III) and 2 August 2028 (Annex I). It also softened the AI literacy duty and added bans on non-consensual sexual deepfakes and child sexual abuse material (CSAM) generation.Next: Dec 2 New bans on sexual deepfakes and CSAM generation; Art 50(2) grace period ends · in 36 daysEU CSAM Interim RegulationLets providers of number-independent interpersonal communications services, such as messaging and email, voluntarily scan for and report online child sexual abuse despite ePrivacy confidentiality rules, under strict conditions. It replaces Regulation (EU) 2021/1232, which expired on 2026-04-03. The permanent CSA Regulation proposed in 2022 is still not adopted.Next: Feb 1, 2028 Commission implementation report · in 15 months
Questions about EU-US Data Privacy Framework
- What are the EU-US Data Privacy Framework compliance deadlines?
- Jul 10, 2023: DPF adequacy decision adopted and effective. Sep 3, 2025: General Court upholds DPF (Latombe v Commission). Oct 31, 2025: Latombe appeal lodged at the Court of Justice.
- When does EU-US Data Privacy Framework take effect?
- EU-US Data Privacy Framework took effect on Jul 10, 2023.
- Who does EU-US Data Privacy Framework apply to?
- EEA exporters transferring personal data to US organisations on the DPF List (self-certified, under FTC or DOT jurisdiction). Transfers to non-certified US recipients still need SCCs/BCRs, which benefit from the same US safeguards.
- What are the penalties under EU-US Data Privacy Framework?
- No standalone fines; unlawful transfers fall under GDPR Art 83(5) (up to EUR 20M or 4% of worldwide turnover). US certified organisations face FTC/DOT enforcement.