Transferring Data to US SaaS: The EU-US Data Privacy Framework Explained

The rule: transfers need a basis

Under Chapter V of the GDPR, personal data can only be transferred outside the EEA on one of its grounds: an adequacy decision (Article 45), appropriate safeguards such as standard contractual clauses (Article 46), or, in limited cases, a derogation (Article 49). Using a US provider that stores or accesses your data counts as a transfer.

What the Data Privacy Framework is

On 10 July 2023 the European Commission adopted Implementing Decision (EU) 2023/1795. Its Article 1 finds that the United States ensures an adequate level of protection for personal data transferred from the EU to organisations in the United States that are included in the Data Privacy Framework List, maintained by the US Department of Commerce.

The one thing to check: adequacy covers only certified organisations. Before relying on it, look the provider up on the official Data Privacy Framework List (dataprivacyframework.gov) and check that its certification is active and covers the type of data you send, for example HR data.

Is it still valid?

Yes, as of this writing. The Commission monitors the framework continuously (Article 3 of the decision). A challenge brought by a French member of parliament was dismissed by the EU's General Court on 3 September 2025 (Case T-553/23, Latombe v Commission). An appeal to the Court of Justice has been reported; until a court rules otherwise, the decision applies. Because the previous frameworks, Safe Harbor and Privacy Shield, were both struck down by the Court of Justice, it is sensible to know your fallback.

How to use it in practice

List your US providers from your records of processing and their sub-processors.
For each, check the Data Privacy Framework List and save a dated screenshot or record of the active certification.
Reference the framework in your data processing agreement and in your privacy notice (Article 13(1)(f) requires you to mention the adequacy decision).
Re-check certifications periodically; organisations can lapse or withdraw.

When the provider is not certified

Use standard contractual clauses adopted by the Commission (Implementing Decision (EU) 2021/914), usually built into the provider's data processing agreement. Under the Court of Justice's Schrems II judgment (C-311/18), you must assess whether the law and practice of the destination country allow the clauses to be complied with, and add supplementary measures where needed. The EDPB's Recommendations 01/2020 describe how to do that transfer impact assessment.

Provider	Transfer basis	What to keep
US, certified under the framework	Adequacy decision 2023/1795	Record of the active certification
US, not certified	Standard contractual clauses 2021/914	Signed clauses and a transfer impact assessment
Another country with an adequacy decision (for example Switzerland or Japan)	That adequacy decision	Note of the decision relied on

Also check where the provider's sub-processors are: a European hosting region does not help if support staff in another country can access the data.

Document your transfers. The GDPR Records of Processing (RoPA) Kit includes RoPA templates with transfer fields, a data inventory workbook and a completion guide.

Transferring Data to US SaaS: The EU-US Data Privacy Framework Explained

The rule: transfers need a basis

What the Data Privacy Framework is

Is it still valid?

How to use it in practice

When the provider is not certified

Sources

Related tools

Data Mapping Tool

Privacy Policy Generator