Transferring personal data out of the EU after the Data Privacy Framework: SCCs, TIAs and the US adequacy decision

How does the GDPR control transfers?

Chapter V of the GDPR (Articles 44 to 49) allows a transfer of personal data to a country outside the European Economic Area only on one of three grounds:

1. an adequacy decision of the Commission for that country, territory or sector (Article 45);
2. appropriate safeguards, most often the Commission's standard contractual clauses, or binding corporate rules (Article 46);
3. a derogation for a specific situation, such as explicit consent or necessity for a contract with the individual (Article 49). Derogations are for specific situations, not for routine flows.

Source: GDPR, Chapter V (Articles 44 to 49), EUR-Lex.

What does the Data Privacy Framework cover?

The Commission's adequacy decision for the EU-US Data Privacy Framework, adopted on 10 July 2023 (Implementing Decision (EU) 2023/1795), covers commercial organisations in the United States that participate in the Framework. The protections it relies on include Executive Order 14086 of 7 October 2022, "Enhancing Safeguards for United States Signals Intelligence Activities".

What to check before relying on it:

• The recipient participates. The US Department of Commerce publishes the list of participating organisations at dataprivacyframework.gov. Check the name, the status and the date.
• The data is covered. Participation is for stated types of data; human resources data needs HR coverage.
• Onward transfers. The recipient's own transfers to its vendors must follow the Framework's onward transfer principle; your contract should say so.

Sources: European Commission, adequacy decisions; Implementing Decision (EU) 2023/1795, with the Framework's Principles in Annex I (including Supplemental Principle 9 on human resources data), EUR-Lex; Executive Order 14086, Federal Register; Data Privacy Framework list.

Is the Framework safe to rely on?

It is in force. On 3 September 2025, the General Court dismissed an action for annulment of the adequacy decision (Case T-553/23, Latombe v Commission), confirming that, on the date the decision was adopted, the United States ensured an adequate level of protection for personal data transferred to organisations under the Framework. A judgment of the General Court can be appealed to the Court of Justice on points of law; check the Court's register for any appeal before relying on the Framework for a new data flow.

The previous arrangement, the Privacy Shield, was invalidated by the Court of Justice in the Schrems II judgment of 16 July 2020. A prudent exporter therefore keeps a fallback: standard contractual clauses signed with its main US recipients, ready to rely on if the decision falls.

Sources: Court of Justice of the EU, press release No 106/25; press release No 91/20 (Schrems II).

When do you need standard contractual clauses?

When the recipient is outside the EEA and not subject to the GDPR, no adequacy decision covers it, and no binding corporate rules apply. The Commission issued modernised standard contractual clauses on 4 June 2021, with four modules:

The parties may supplement the clauses with additional clauses or incorporate them into a broader commercial contract, as long as nothing in the other terms contradicts the clauses. The clauses are designed for importers outside the EEA that are not themselves subject to the GDPR.

Sources: Implementing Decision (EU) 2021/914, EUR-Lex; European Commission, standard contractual clauses; Commission questions and answers on the clauses.

What is a transfer impact assessment, and when do you need one?

In line with the Schrems II judgment, Clause 14 of the standard contractual clauses requires the parties to assess, before concluding the clauses, whether the laws and practices of the destination country could prevent the importer from complying with them, and to document that assessment. The European Data Protection Board's Recommendations 01/2020, adopted in final form on 18 June 2021, describe how to do it: know your transfers; identify the transfer tool; assess the destination's law and practice; adopt supplementary measures where needed; take any formal steps; and re-evaluate at intervals.

For a US recipient that does not participate in the Framework, the assessment can take account of the US safeguards the Commission examined in its adequacy decision, including Executive Order 14086: the Commission states that these safeguards apply to all transfers to companies in the US under the GDPR, whatever transfer tool is used. For other countries, the assessment has to be done country by country.

Sources: EDPB, Recommendations 01/2020; European Commission, questions and answers on the EU-US Data Privacy Framework (question 7).

What about transfers to AI providers?

Sending personal data to a model API or an inference host outside the EEA is a transfer like any other. Check whether the provider participates in the Framework (and for which data), which entity you contract with, where inference and logging take place, which sub-processors it uses, and whether it may use your data to train its models. The data processing agreement should answer each point (see Do you need a DPA?).

Checklist

• Map every transfer: data, recipient, country, purpose, tool relied on
• For US recipients: participation checked on the official list, with the date and the data covered
• For everyone else: standard contractual clauses, with the right module
• Transfer impact assessment documented (Clause 14), with supplementary measures where needed
• Onward transfers and sub-processors covered in the contract
• Fallback clauses in place for key US recipients that rely on the Framework
• Review date set, and a trigger for any court ruling on the Framework

Questions people ask

Do we need SCCs if the US recipient participates in the Framework? Not for the transfer to that recipient, as long as the adequacy decision stands and the participation covers the data. Many companies sign them anyway as a fallback.

Do we need a TIA for a participating US recipient? Not for transfers covered by the adequacy decision. A TIA is needed when you rely on the standard contractual clauses.

What if the decision is annulled? Transfers relying only on the Framework would lose their basis. Standard contractual clauses already signed, with a documented assessment, would allow transfers to continue while the situation is assessed.

Is consent a good basis for transfers? Rarely. Explicit consent under Article 49(1)(a) is for specific situations, and it can be withdrawn.

Update log

• 16 October 2026: first published; sources checked and citations added the same day.