“They're certified under the Data Privacy Framework”
The EU-US adequacy decision covers this
It still stands. The American watchdog it leans on has one member left out of five.
The EU-US Data Privacy Framework is the arrangement that currently allows personal data to move from Europe to certified American companies. It is in force, and Europe's General Court upheld it in September 2025, with an appeal still pending. Two things about the machinery behind it are worth knowing. The independent American oversight board that the European Commission relied on, when it judged Europeans to be protected, has been unable to take decisions since three of its five members were removed in January 2025. And the complaints route offered to Europeans was created by a presidential order, which the same office can rewrite.
What this does not settle. The outcome of the court case over those removals, after the American Supreme Court ruled in June 2026, could not be confirmed.
Commission Implementing Decision (EU) 2023/1795 · checked 2026-09-04
What to ask instead
What is your plan for those systems if the EU-US data deal is struck down on appeal?
The arrangement is in force today, and it is under appeal. Anyone running a public service should have an answer ready for what happens to those systems if the appeal succeeds.
If the answer is a European company you can name, that settles it.
Which of these is true of your company?
The test asks which tools you actually use, then answers this question for each of them from the same documents — and shows what your own domain says. A few minutes, no account, nothing kept.
Run it on your own company