EU–US Data Privacy Framework
The framework under which the European Commission found that personal data sent to certified US companies is adequately protected (Commission Implementing Decision (EU) 2023/1795).
The Commission adopted the adequacy decision on 10 July 2023. It covers transfers to US organisations that self-certify with the US Department of Commerce and appear on the Data Privacy Framework List; transfers to other US companies still need another mechanism, such as standard contractual clauses. It replaced the EU–US Privacy Shield, which the Court of Justice invalidated in Schrems II.
In a vendor review, the practical question is whether each US subprocessor is certified, and for which kinds of data.
Source: Commission Implementing Decision (EU) 2023/1795 ↗
Related terms
ClauseTrail watches vendors' subprocessor lists, DPAs, privacy policies, terms and AI terms, and tells your team what changed and by when to object.