The Wait Is Over: European Commission Issues Adequacy Decision For EU-US Data Privacy Framework

On July 10, 2023, the European Commission ("Commission") adopted an adequacy decision for the EU-US Data Privacy Framework ("DPF"). In light of this decision, personal data can flow from the EU to US companies that certify that they comply with the DPF without additional safeguards or other transfer mechanisms, such as the Standard Contractual Clauses ("SCCs"). While this decision affects only EU to US transfers, similar decisions are expected for UK to US transfers and Switzerland to US transfers. This is a landmark decision that presents the simpler solution to cross-border transfers that many multinational US companies have been waiting for over the past three years.

What is an Adequacy Decision, and Why does it Matter?