--- title: "United States — Cross-Border & Adequacy | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/united-states/cross-border-and-adequacy/ source_html: /jurisdictions/united-states/cross-border-and-adequacy/index.html description: "United States — Cross-Border & Adequacy: cross_border_and_adequacy Cross-Border & Adequacy 6 sub-modules 5 claims Amber ▾ # The adequacy arrangement (DPF) is operative but subject to EDPB-recommended periodic review and o" generated_at: 2026-10-25T04:46:50Z content_sha256: adfeb1933b4f258835e2f18838fea79c8f1da2fa44912cfc6d96e1275c6278cf generator: "fe-fleet/md-twin@1.0" --- # United States — Cross-Border & Adequacy | Data Protection Monitor ### D5Cross-Border & Adequacy6 sub-modules5 claimsAmber▾# The adequacy arrangement (DPF) is operative but subject to EDPB-recommended periodic review and ongoing NGO legal challenge risk; PADFAA adds a novel outbound-restriction layer not previously present in US law. Primary framework EU-US Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795); PADFAA (2024) Supervisory authority [US Department of Commerce, International Trade Administration (DPF Program)](https://www.dataprivacyframework.gov) Traffic-light rationale — Amber The adequacy arrangement (DPF) is operative but subject to EDPB-recommended periodic review and ongoing NGO legal challenge risk; PADFAA adds a novel outbound-restriction layer not previously present in US law. #### Sub-modules (6) #### Transfer MechanismsAmber US organizations may self-certify to the EU-US DPF (and the parallel Swiss-US DPF) as an inbound transfer mechanism from the EEA/Switzerland; SCCs and BCRs remain in parallel use by many companies as a second layer of protection. Claims (2): - As of March 2026, more than 3,500 US companies have self-certified to the EU-US Data Privacy Framework, with the majority being small and medium-sized enterprises. - Companies with sufficient resources continue to maintain Standard Contractual Clauses in place alongside DPF self-certification to provide a second layer of legal transfer protection. #### Adequacy ReceivedAmber This sub-module concerns adequacy decisions the US regime receives from other regimes recognizing US law as adequate; none were identified distinct from the DPF mechanism itself. Absence provenance: unavailable . Searched: US receiving adequacy from other jurisdictions 2026. #### Adequacy GrantedAmber The European Commission granted an adequacy decision to the US via the EU-US Data Privacy Framework on 10 July 2023, enabling free flow of personal data from the EEA to certified US recipients. Claims (2): - The European Commission adopted its adequacy decision for the EU-U.S. Data Privacy Framework on 10 July 2023, concluding that US protection of personal data transferred between the countries is comparable to that offered in the EU. - The EDPB has recommended that the next review of the EU-US adequacy decision take place within three years or less, reflecting ongoing supervisory monitoring of the DPF's operation. #### Sccs And BcrsAmber US companies commonly maintain SCCs and BCRs alongside DPF certification as a resilience layer given ongoing litigation risk to the DPF. Claims (1): - Companies with sufficient resources continue to maintain Standard Contractual Clauses in place alongside DPF self-certification to provide a second layer of legal transfer protection. #### Transfer Impact AssessmentAmber No US-specific statutory transfer-impact-assessment obligation was identified; TIA practice in this corridor is driven by EU-side GDPR obligations rather than US law. Absence provenance: unavailable . Searched: US transfer impact assessment requirement. #### Data LocalisationAmber No general US data-localisation mandate was identified; PADFAA restricts specific outbound sensitive-data transactions rather than mandating in-country storage. Claims (1): - PADFAA restricts data brokers from selling, releasing, disclosing, or providing access to Americans' sensitive data to entities controlled by North Korea, China, Russia, or Iran, functioning as a targeted outbound-transfer restriction rather than general localisation. Category narrative 92 words The US is the recipient of an EU adequacy-style instrument — the EU-US Data Privacy Framework (DPF) adequacy decision, adopted by the European Commission on 10 July 2023 — which permits data to flow from the EEA to self-certified US organizations. The DPF is administered by the US Department of Commerce and backstopped by a Data Protection Review Court redress mechanism. Separately, PADFAA restricts outbound transfers of Americans' sensitive data to a defined list of foreign-adversary states, functioning as a US-side export control rather than a transfer-mechanism framework in the GDPR sense. no periodic updates on record for this sub-brief Evidence 5 Sources and claims (5) - Probable[IAPP](https://iapp.org/news/a/european-commission-adopts-eu-u-s-adequacy-decision) — The European Commission adopted its adequacy decision for the EU-U.S. Data Privacy Framework on 10 July 2023, concluding that US protection of personal data transferred between the countries is comparable to that offered in the EU.observed 2026-07-29 - Probable[EDPB](https://www.edpb.europa.eu/news/news/2024/edpb-adopts-its-first-report-under-eu-us-data-privacy-framework-and-statement_en) — The EDPB has recommended that the next review of the EU-US adequacy decision take place within three years or less, reflecting ongoing supervisory monitoring of the DPF's operation.observed 2026-07-29 - Probable[IAPP](https://iapp.org/news/a/iapp-global-summit-2026-on-the-state-of-the-trans-atlantic-data-transfer-agreement) — As of March 2026, more than 3,500 US companies have self-certified to the EU-US Data Privacy Framework, with the majority being small and medium-sized enterprises.observed 2026-07-29 - Probable[IAPP](https://iapp.org/news/a/iapp-global-summit-2026-on-the-state-of-the-trans-atlantic-data-transfer-agreement) — Companies with sufficient resources continue to maintain Standard Contractual Clauses in place alongside DPF self-certification to provide a second layer of legal transfer protection.observed 2026-07-29 - Probable[FTC](https://www.ftc.gov/news-events/news/press-releases/2026/02/ftc-reminds-data-brokers-their-obligations-comply-padfaa) — PADFAA restricts data brokers from selling, releasing, disclosing, or providing access to Americans' sensitive data to entities controlled by North Korea, China, Russia, or Iran, functioning as a targeted outbound-transfer restriction rather than general localisation.observed 2026-07-29