“They're certified under the Data Privacy Framework”
The EU-US adequacy decision covers this
It still stands. The American watchdog it leans on has one member left out of five.
The EU-US Data Privacy Framework is the arrangement that currently allows personal data to move from Europe to certified American companies. It is in force, and Europe's General Court upheld it in September 2025, with an appeal still pending. Two things about the machinery behind it are worth knowing. The independent American oversight board that the European Commission relied on, when it judged Europeans to be protected, has been unable to take decisions since January 2025, when three of its members were removed. Its own annual report records the position at the end of its 2025 financial year: one serving member and four empty seats, where three are needed before it can decide anything. And the complaints route offered to Europeans was created by a presidential order, which the same office can rewrite.
What this does not settle. The outcome of the court case over those removals, after the American Supreme Court ruled in June 2026, could not be confirmed.
Commission Implementing Decision (EU) 2023/1795 · in force · checked 2026-09-04
Privacy and Civil Liberties Oversight Board, Agency Financial Report, FY 2025, 14 November 2025
What to ask instead
What is your plan for those systems if the EU-US data deal is struck down on appeal?
The arrangement is in force today, and it is under appeal. Anyone running a public service should have an answer ready for what happens to those systems if the appeal succeeds.
If the answer is a European company you can name, that settles it.
Read further
Which of these is true of your company?
The test asks which tools you actually use, then answers this question for each of them from the same documents — and shows what your own domain says. A few minutes, and your answers stay in this tab.
Run it on your own company