In short
The EU-US Data Privacy Framework has applied since 10 July 2023 and allows transfers to US companies with an active entry on the official DPF List. The EU General Court upheld it in 2025, an appeal is pending, and the Commission is assessing a 2026 US ruling on the FTC. Check the listing and keep standard contractual clauses ready.
Legal basis: since 10 July 2023, personal data may flow from the EU to US companies certified under the EU-US Data Privacy Framework (DPF).
Listing required: protection applies only to organisations with an active entry on the US Department of Commerce's DPF List.
Upheld, but contested: the EU General Court dismissed a challenge in September 2025. An appeal is pending, and a 2026 US ruling has prompted new scrutiny.
DPA still required: the DPF only replaces the transfer mechanism, not the data processing agreement.
Many SaaS vendors are based in the US. Using their tools means transferring personal data to a third country, and the GDPR requires a specific legal basis for that. Since July 2023 this has usually been the EU-US Data Privacy Framework. This guide explains what the DPF does, how to check a vendor on the official list and how stable the framework is in November 2026.
What is the EU-US Data Privacy Framework?
The DPF is a European Commission adequacy decision covering certified US companies. The Commission adopted it on 10 July 2023 (Implementing Decision (EU) 2023/1795). It finds that participating US organisations ensure an adequate level of protection. Under Article 45 GDPR, a transfer on this basis needs no specific authorisation.
It builds on a US Executive Order from October 2022. The order limits access by US intelligence agencies and creates a redress mechanism for Europeans, the Data Protection Review Court. According to the European Commission, these safeguards apply to all transfers to the US, including those under standard contractual clauses.
How does certification work?
US companies self-certify with the US Department of Commerce. The International Trade Administration (ITA) runs the programme. Participation is voluntary. Once certified, however, a company must comply with the DPF Principles, and that commitment is enforceable under US law. This is how the ITA's programme overview describes it.
Annual re-certification: companies must renew their certification every year.
Removal: the ITA removes companies that withdraw, miss re-certification or persistently fail to comply.
Extensions: the UK Extension has applied since 12 October 2023, the Swiss-U.S. DPF since 15 September 2024.
How do you check a vendor on the DPF List?
Check the entry yourself instead of trusting a badge. The official Data Privacy Framework List is publicly searchable. Proceed as follows:
Search for the US parent company, not only the product name.
Check the status: only “Active” counts. Removed companies appear under “Inactive”.
Open the “EU-US Certification” row and check its status.
Check the data types: “Non-HR Data” covers customer data, “HR Data” covers employee data.
Look under “Covered Entities” to see whether the subsidiary you contract with is included.
An example from our search on 13 November 2026: Slack is not listed under its own name. Slack Technologies, LLC is included as a covered entity of its parent company Salesforce. Microsoft Corporation, Zoom and Mattermost, Inc. are listed as active for HR and non-HR data. We found no entry for Rocket.Chat. Instead, Rocket.Chat's DPA relies on the EU standard contractual clauses. Our team chat comparison shows how the tools compare otherwise.
Vendor | DPF status (checked 13 Nov 2026) | Note |
|---|---|---|
Microsoft (Teams) | Active | entry Microsoft Corporation |
Slack | Active | covered entity of Salesforce |
Zoom | Active | entry Zoom |
Mattermost | Active | entry Mattermost, Inc. |
Rocket.Chat | no entry found | DPA with standard contractual clauses |
How stable is the DPF in November 2026?
The DPF is in force, but under scrutiny. On 3 September 2025, the EU General Court dismissed the action for annulment brought by French MP Philippe Latombe (Case T-553/23). According to the Court's press release, the US ensured an adequate level of protection when the decision was adopted. According to the law firm WilmerHale, Latombe appealed to the Court of Justice on 31 October 2025. We were not aware of a judgment on the appeal at the time of writing.
A US Supreme Court ruling of 29 June 2026 (Trump v. Slaughter) raises new questions. It allows the US President to remove members of the Federal Trade Commission (FTC). On 31 July 2026, the European Data Protection Board asked the Commission in a letter to assess closely whether this affects the adequacy decision. The decision explicitly relies on the FTC's independence. According to the law firm Hunton Andrews Kurth, a Commission spokesperson announced an assessment. The decision has not been revoked.
The Commission reviews the decision periodically. It presented its first review report on 9 October 2024. According to eucrim, it reaffirmed cooperation with the US authorities and announced it would follow up on open points. For businesses, this means the basis holds today, but its future is not guaranteed.
What should businesses do now?
Use the DPF, but plan a fallback. In our view, these steps make sense:
Check the DPF entry for every US tool and document the date.
Check whether the DPA also includes standard contractual clauses. They apply if the DPF falls away.
For sensitive data, check whether the vendor offers EU data residency, such as Microsoft's EU Data Boundary.
For highly sensitive data, consider self-hosted alternatives.
The DPF does not replace a data processing agreement. It only governs the legal basis for transfers to the US. Our SaaS selection checklist shows how to build both into your software selection. The glossary entry on the GDPR explains the framework. Next, check the US tools that hold the most customer or employee data.
Frequently asked questions
Do I still need a DPA with DPF-certified vendors?
Yes. The DPF only covers the transfer to the US. If the vendor is a processor, Article 28 GDPR still requires a data processing agreement.
What happens if the DPF is invalidated?
The Article 45 basis for transfers would fall away. Businesses would have to switch to other tools such as standard contractual clauses. Check whether your DPA already contains them.
Does the DPF cover employee data?
Only if the company is certified for “HR Data” on the list. This appears in the listing next to “Non-HR Data”.
Is a DPF badge on the vendor's website enough?
No. What counts is an active entry on dataprivacyframework.gov. Only listed companies may rely on the DPF.
Sources
- Data Privacy Framework (DPF) Program Overview , International Trade Administration, U.S. Department of Commerce
- Data Privacy Framework List , International Trade Administration, U.S. Department of Commerce
- EU-US data transfers , European Commission
- Press Release No 106/25: Judgment of the General Court in Case T-553/23, Latombe v Commission , Court of Justice of the European Union , 2025-09-03
- European Court of Justice to Review Challenge to EU-U.S. Data Privacy Framework , WilmerHale , 2025-12-01
- Letter to Commissioner McGrath: US Supreme Court judgment Trump v. Slaughter , European Data Protection Board , 2026-07-31
- U.S. Supreme Court FTC Ruling Prompts Fresh Scrutiny of EU-U.S. Data Privacy Framework , Hunton Andrews Kurth , 2026-07-02
- Standard contractual clauses (SCC) , European Commission
- Data Processing Agreement (GDPR) , Rocket.Chat
- First Periodic Review of the EU-US Data Privacy Framework , eucrim
