The EU-US Data Privacy Framework (DPF) is the basis on which companies may transfer personal data to certified US companies without agreeing further safeguards. For many AI services with a US link, it is the basis for the transfer.
If you use AI on company data, you should know what the DPF covers and what it doesn't. It is already the third attempt: the Court of Justice of the EU struck down both predecessors, and in autumn 2026 the DPF is under review again.
- Since 10 July 2023, the Data Privacy Framework has allowed transfers of personal data to US companies certified under it.
- As of 28 October 2026 the decision still applies. An appeal is pending at the CJEU, and the European Data Protection Board has asked the Commission for a fresh assessment.
- The DPF governs the transfer, not US authorities’ access to data a US provider stores in Europe. Plan an exit for AI services.
What is the Data Privacy Framework?
The GDPR only allows transfers of personal data to countries outside the EU under conditions. The simplest is an adequacy decision by the European Commission, which finds that a country offers a comparable level of protection. For the US, the Commission adopted such a decision on 10 July 2023: the Data Privacy Framework.
Unlike for most countries, the decision does not cover every recipient. It only covers US companies that have self-certified with the US Department of Commerce and appear on the public DPF list. If a provider is not listed, the transfer needs another basis, such as standard contractual clauses.
| Framework | In force from | End |
|---|---|---|
| Safe Harbor | 2000 | declared invalid by the CJEU on 6 October 2015 (Schrems I) |
| Privacy Shield | 2016 | declared invalid by the CJEU on 16 July 2020 (Schrems II) |
| Data Privacy Framework | 10 July 2023 | in force as of 28 October 2026 |
Both predecessors failed on the same point: the CJEU found US intelligence access to European data insufficiently limited. The DPF therefore relies on US Executive Order 14086 of October 2022, which is meant to limit access to what is “necessary and proportionate” and creates a redress court for individuals in the EU and EEA.
Legal status in October 2026
The DPF is in force. At the same time, two developments are worth watching.
First, the appeal. The EU General Court dismissed a challenge to the decision on 3 September 2025. The applicant appealed to the Court of Justice; a ruling is pending.
Second, US oversight. The decision relies in part on the independence of the US Federal Trade Commission. On 29 June 2026, the US Supreme Court ruled that the President may remove FTC members without cause. The European Data Protection Board then asked the Commission on 31 July 2026 to assess whether this affects how the DPF functions. We are not aware of a Commission decision on this as of publication.
Nobody can say for certain what follows. One thing is clear: a framework that has been struck down twice and is under review again is not a basis to rely on alone in the long term.
What the Data Privacy Framework does not cover
The DPF is often read as a blanket permission for US services. It is not. It answers one specific question and leaves others open:
What the DPF does not cover
- US authorities’ access under the CLOUD Act to data a US provider stores in Europe.
- Whether the provider uses your data to train its own models: only your contract covers that.
- Sub-processors that are not certified themselves.
What the DPF covers
- Whether personal data may be transferred to a certified US recipient.
- Which data protection principles that recipient must follow.
- Which redress routes individuals in the EU have.
The first point matters especially for AI. Many US providers store data in European data centres and point to the EU region. For access under US law, though, what counts is who holds the data, not where. More in our post on the CLOUD Act.
Checking AI providers with a US link
An AI service moves more data than file storage: documents, questions, answers, logs and the passages sent to a language model with every request. Check every provider with a US link before you hand over personal data:
All points ticked. Well prepared.
The check belongs in your documentation, often in a data protection impact assessment too. For the location question, the free AI provider location check helps.
Plan B: what applies if the DPF falls?
If the DPF fell, data could no longer flow to US recipients on that basis alone. What would mainly remain are standard contractual clauses, plus an assessment of whether protection actually works in the recipient country. After the rulings of 2015 and 2020, many companies had to do exactly that under time pressure.
Know your data flows which service sends which data to the USAgree a fallback standard contractual clauses in the contract todayPlan the exit test export and switch in advanceKeep sensitive data local a provider in Germany or your own servers
For data you don't want to send to the US, running it yourself is the clear route: if you self-host RAGSuite with a local model, no request leaves your network. In RAGSuite Engine, documents and history sit in a data centre in Germany; where the AI runs there and what that means for the CLOUD Act, we answer openly under “Where does the AI run?”. If you choose an external model, the question and matching passages go to that provider, and the checks above apply to it just the same.
This is general information, not legal advice. Have your specific situation assessed by your data protection adviser.
See how to run AI on your data: 7 days free in RAGSuite Engine or in a call with Stefan.
Frequently asked questions
What is the Data Privacy Framework?
The EU-US Data Privacy Framework is an adequacy decision by the European Commission of 10 July 2023. It allows transfers of personal data to US companies certified with the US Department of Commerce without extra safeguards such as standard contractual clauses. It does not apply to recipients that are not certified.
Is the Data Privacy Framework still valid?
Yes, as of 28 October 2026 the decision applies. The EU General Court dismissed a challenge in September 2025, and the appeal at the CJEU is pending. The European Data Protection Board also asked the Commission for a fresh assessment in July 2026. Plan a fallback for that reason.
May I use an AI service from the US?
That depends on which data you process and on what basis it is transferred. If the provider is DPF-certified, transferring personal data is possible in principle. Also check sub-processors, training, the data path to the language model and your GDPR duties, such as a data protection impact assessment.
Does the DPF protect against the CLOUD Act?
No. The DPF governs whether data may be transferred to the US. The CLOUD Act requires US providers to hand over data on order, even when it is stored in Europe. What matters is who holds the data. A provider without a US link, or running it yourself, makes the question much smaller; still check owners and sub-processors. On RAGSuite Engine: RAGSuite Engine is hosted in Germany; AI processing in the EU/EFTA (Microsoft Azure). Microsoft is a US company, and we say so openly; for data that must not touch a US company, there is your own API key or your own servers.
What happens if the DPF is declared invalid?
Then transfers based on the DPF alone lose their basis. Companies would have to switch to standard contractual clauses with an assessment of the protection level, or stop the transfer. If you have settled fallback, data export and alternatives in advance, you can respond without time pressure.
Sources
- Commission Implementing Decision (EU) 2023/1795 (10 July 2023): DPF adequacy decision
- Data Privacy Framework List (US Department of Commerce): certified companies
- EU General Court: Case T-553/23, Latombe v Commission: judgment of 3 September 2025
- CJEU: Case C-703/25 P: appeal, pending
- CJEU: Case C-311/18 (Schrems II, 16 July 2020): Privacy Shield invalid
- EDPB: letter to the Commission (31 July 2026): request for assessment after Trump v. Slaughter
- Executive Order 14086 (7 October 2022): limits on US signals intelligence
Stefan works with customers in public administration and regulated industries. He writes about the GDPR, the EU AI Act, works councils and tenders.