If the Court of Justice annulled the EU US Data Privacy Framework decision, transfers that relied on it would need another basis, such as standard clauses. The right time to prepare is now. A plan that is written, tested and owned beats a scramble after the ruling.
What would change
An adequacy decision is what lets data flow without extra safeguards. If it fell, each vendor flow relying on it would lose that basis. Article 44 says transfers need Chapter V conditions to be met, and Article 49 derogations are narrow, so they are not a general substitute.
The earlier cases show how it can go. The Court invalidated Safe Harbour and then Privacy Shield, and in the second case the Court's press release says nothing about a grace period being added. I could not confirm details beyond that, so ask your counsel how a ruling would apply.
What would stay valid
Other mechanisms in Article 46 are separate. Standard clauses, binding corporate rules and approved codes of conduct do not depend on the framework. The Commission issued modernised standard clauses on 4 June 2021. Adequacy decisions for other countries are also unaffected.
The contingency plan
- List every vendor that receives EU personal data and mark which rely on the framework alone.
- Ask each of them for signed standard clauses now, and file them.
- Identify the data fields each vendor truly needs. Remove or tokenise the rest.
- Decide which vendors could be replaced by an EU hosted option, and what that would cost in time.
- Draft customer communication that explains the mechanism change in plain words.
- Assign an owner who watches the court register and the Commission page.
- Update your privacy notice and records of processing when the mechanism changes.
Technical measures that reduce exposure
Encryption and pseudonymisation are named in Article 32 as examples of appropriate security. If you encrypt before sending and keep the key under your control, the vendor sees less. Whether that is enough for a given transfer is a legal question, but it shrinks what depends on the answer.
Quick check
Would a ruling be retroactive?
That depends on the ruling. Article 45(5) says Commission acts repealing a decision apply without retroactive effect, but a court annulment is different. Ask counsel.
Should I move all data to the EU today?
Not necessarily. Map the flows first, then decide which vendors justify the effort.
Sources
- GDPR Article 44
- GDPR Article 45
- GDPR Article 49
- GDPR Article 32
- Court of Justice press release on Schrems II
- European Commission: standard contractual clauses
Last reviewed: 19 October 2026.
