EU–US data transfers: what the Data Privacy Framework means for an outsourcing provider
The transatlantic framework survived at first instance, but an appeal is pending. Why a European client should look at where its data is processed, and what to ask.
As soon as an outsourcing provider accesses your data, the question arises: where is it processed, and under what legal regime? For transfers between the European Union and the United States, the current framework is the Data Privacy Framework (DPF), recognized as "adequate" by the European Commission in 2023. Its solidity is a live issue in 2026.
Where the DPF stands
On 3 September 2025, the EU General Court dismissed Philippe Latombe’s challenge and confirmed the validity of the adequacy decision. An appeal was lodged with the Court of Justice on 31 October 2025 (Case C-703/25 P). According to legal commentators, no hearing was scheduled as of summer 2026 and a Court opinion is hardly expected before late 2026 or early 2027 (WilmerHale, European Martech). The appeal doesn’t suspend the decision: transfers based on the DPF remain allowed during the proceedings.
History justifies caution
The two earlier frameworks, Safe Harbor and then Privacy Shield, were both invalidated by the Court of Justice, with immediate effect. A company whose whole processing rested on the DPF with no fallback would face an abrupt break if history repeated itself. That is not a prediction, it is a risk to manage.
What it means for outsourcing
The question isn’t only about the provider’s headquarters, but the whole chain: the tools it uses (email, CRM, storage, AI assistants), their subprocessors and hosting locations. A dedicated collaborator working on your tools and within your secure environment doesn’t export your data; a flow passing through a third-party service hosted outside the EU does.
Five questions to ask
- Where is your data stored and processed, and by which subprocessors?
- What legal basis underlies each transfer outside the EU: adequacy decision, standard contractual clauses, other?
- Is there a fallback plan if the DPF were invalidated? Ideally, standard contractual clauses already signed and a documented impact assessment.
- Is access limited and logged (VPN, minimal rights, secure workstations)?
- Can data be repatriated in an open format, within a defined timeframe?
Compliance that varies by country
Clients in Switzerland or Canada fall under regimes of their own (FADP/nFADP, PIPEDA) with their own transfer mechanisms. That is why a multi-country provider’s compliance isn’t reducible to "being GDPR-compliant": it consists in keeping the map of applicable regimes current according to where the client operates. Our Compliance page details this approach.
This article is general information, not legal advice: analyzing a transfer depends on the facts of each situation.
Sources
A question about your situation?
Let’s talk about your compliance and outsourcing needs.