10 FAQs About The New EU/US Data Privacy Framework

If your company transfers personal data from the European Union into the U.S., chances are you are aware of the EU's rigorous data privacy regulations. In order to comply with the General Data Protection Regulation (GDPR), a company transferring data from the EU must use a transfer mechanism that has been determined to be adequate by the EU. The three primary transfer mechanisms are standard contractual clauses, binding corporate rules, and adequacy decisions issued by the European Commission (the "EC").

Previously, from July 2016 to July 2020, many companies relied on the EU/US Privacy Shield, a transfer mechanism arising out of an EC adequacy decision. However, in July of 2020, Privacy Shield was invalidated by the Court of Justice of the EU as a result of the Schrems II case. Following its invalidation, many companies instead relied on standard contractual clauses or SCCs (requiring signatures by data controllers and data processors), which were updated by the