O Oluma Cyber Security Framework Files · No. 15 Mechanism · Transatlantic Data Transfer EU–US Data Privacy Framework The bridge that lets EU personal data flow legally to US companies — the third attempt after two were struck down, valid today but under fresh legal pressure. Adequacy 2023Self-cert via CommerceDPRC redressContested 2026 DPF EU→USDPRCCERT How we’ll read this 01 The Problem02 Why It Exists03 The Story04 How It Works05 Example06 Who Uses It07 Career08 Strengths & Challenges09 Takeaway 01 The Problem GDPR won’t let data leave without protection Under GDPR, personal data can’t simply flow from the EU to another country unless that country offers essentially equivalent protection. The problem: EU courts have repeatedly found that US surveillance law doesn’t meet that bar, because intelligence agencies could access EU citizens’ data with too little oversight or redress. Yet the transatlantic economy runs on data crossing the ocean constantly. Something had to legally bridge two very different privacy regimes — or the flows would be unlawful. 02 Why It Was Created A legal bridge across the Atlantic The Data Privacy Framework is that bridge. It lets US companies self-certify to a set of privacy principles, backed by binding US government commitments to limit intelligence access and give Europeans a real way to seek redress. The core ideaIf the US as a whole can’t be declared “adequate,” create a certified club of US companies that promise GDPR-grade handling — plus new government guardrails — so data can flow to them specifically. Certify, and EU data can flow to you without extra contracts for those transfers. It’s convenience built on a fragile legal foundation. 03 The Story Behind It Two frameworks struck down, a third in the balance 2000 → 2015Safe HarborThe first transfer framework — invalidated by the EU’s top court in 2015 over US surveillance concerns (the “Schrems I” case). 2016 → 2020Privacy ShieldThe strengthened successor — also struck down, in 2020 (“Schrems II”), for the same fundamental flaws. 2023Data Privacy FrameworkThe third attempt. Backed by a US executive order and a new Data Protection Review Court, the European Commission granted adequacy on 10 July 2023. 2025–26Tested againIn September 2025 the EU General Court upheld the DPF, but that ruling is under appeal to the EU’s highest court, and 2025–26 questions about US oversight bodies have added fresh uncertainty. It remains valid law today. 04 How It Works Self-certify, commit, and provide redress The framework rests on three pillars — a promise by companies, guardrails by government, and a way for individuals to complain. Self-certificationGovernment commitmentsIndependent redress CompaniesSelf-certifyUS organizations publicly commit to the DPF privacy principles and register through the Department of Commerce — an enforceable promise. GovernmentSurveillance limitsA US executive order restricts intelligence access to what’s necessary and proportionate, addressing the courts’ core concern. IndividualsThe Data Protection Review CourtA new, independent redress body lets EU individuals challenge how US agencies handle their data — the mechanism earlier frameworks lacked. If it falls, what then?The DPF isn’t the only route. Companies can still transfer data using Standard Contractual Clauses plus a transfer impact assessment — more paperwork, but a fallback if adequacy is ever lost again. 05 Real-World Example A US SaaS keeps serving European customers A US SaaS company has European users, which means their personal data crosses the Atlantic every day. To keep that lawful and simple, it joins the framework — while keeping a backup plan, given the legal history. Their transfer strategyCertify now, hedge for later Self-certify to the DPF principles via the Department of Commerce Publish a compliant privacy notice and honor EU rights Rely on the DPF to move EU data without extra contracts Keep Standard Contractual Clauses ready as a fallback Watch the pending court appeal closely The framework makes today simple and lawful — but wise companies remember the last two bridges were torn down. 06 Who Uses It Anyone moving personal data across the Atlantic ☁️US tech & SaaSCompanies with EU users or customers who need a clean legal basis for data transfers. 🌍MultinationalsGlobal firms moving employee and customer data between EU and US operations. ⚖️Privacy & legal teamsCounsel who must choose and defend the transfer mechanism their business relies on. It sits within the broader GDPR transfer toolkit. under GDPRalternative to SCCsrelates to UK Extensionmaps to ISO 27701 07 Career Relevance Where privacy law meets geopolitics International data transfers are one of the trickiest, most-watched corners of privacy — and understanding the DPF (and its fragility) is a mark of a serious privacy professional. Privacy counselChoose the mechanismAdvise which transfer route to use, and keep fallbacks ready as the legal ground shifts. DPO / privacy leadCertify & maintainManage self-certification, notices, and the ongoing obligations the framework demands. GRC & vendor riskAssess data flowsTrack where personal data actually goes and which legal basis covers each hop — core third-party-risk work. Knowing not just how the DPF works but how exposed it is separates informed advisors from box-tickers. 08 Strengths & Challenges Honest trade-offs ✦ Strengths Simplifies lawful EU–US data transfers Removes the need for extra contracts on covered flows Adds real government surveillance limits Creates an independent redress body for individuals Currently valid and upheld once in court ⚠ Challenges Two predecessors were struck down — history looms A court appeal is pending at the EU’s highest court Depends on US oversight bodies staying independent Only covers certified US organizations Prudent firms must keep a fallback ready 09 Final Takeaway The DPF is the bridge holding up transatlantic data flows — standing today, but built on contested ground.It’s the third attempt to reconcile European privacy rights with American surveillance law, and it works — for now. Understand how it operates and how fragile it is, and you’ll advise far better than anyone who assumes the bridge will simply always be there.