If you rely on the EU US Data Privacy Framework for a US vendor, confirm that the vendor is a current participant, that the data type you send is covered, and write down the date. Also keep a fallback such as standard contractual clauses, because the framework is under appeal at the Court of Justice.
What the framework is
The Commission adopted its adequacy decision for the framework on 10 July 2023, covering transfers to US commercial organisations that participate. It is not a blanket approval of the United States. The Commission's adequacy page describes it as applying to commercial organisations in the framework, and published its first periodic review report on 9 October 2024.
Where the legal challenge stands
The General Court dismissed an action against the decision on 3 September 2025 in case T-553/23. The applicant appealed on 31 October 2025, and the appeal is registered as C-703/25 P. The Official Journal notice says the appeal rests on four grounds about the independence of the Data Protection Review Court and US bulk data collection and executive powers under Executive Order 14086.
I could not confirm the current status of the appeal. Check the Court of Justice register before you depend on the framework.
A vendor check you can repeat
- Ask the vendor to state which mechanism it uses for EU data: framework participation, standard clauses, or both.
- If it says framework, check the official participant list yourself rather than trusting a badge on a web page.
- Confirm the scope covers your data type. Participation can be limited to certain categories, so read the entry.
- Record the check date and who did it.
- Ask whether standard clauses are available as a fallback and sign them if so.
- Ask for the list of sub-processors and where they sit.
Build for change
Designs that survive a ruling share a trait: they depend on fewer legal assumptions. Encrypt sensitive fields before they reach the vendor, limit what you send, and keep an exit plan. See what happens if the framework is struck down.
Quick check
Is a vendor automatically covered because it is a US company?
No. The decision applies to participating commercial organisations, so check participation and scope.
Do I still need standard clauses?
Not strictly while the decision stands, but many teams keep them signed as a fallback. Ask your counsel.
Sources
Last reviewed: 19 October 2026.
