The European Union (EU) has adopted an adequacy decision on the new EU-US Data Privacy Framework under Article 45(3) of the General Data Protection Regulation, recognizing the US as a country with adequate measures in place for the protection of personal data, and allowing compliant organizations to transfer personal data freely from the EU to the US with no additional security measures.

The decision follows a March 2022 agreement in principle between the EU and the US on data protection commitments and the subsequent adoption of an executive order and several regulations on consumer privacy in October of the same year. 

Two previous transatlantic data privacy deals have been invalidated by the EU Court of Justice—“Privacy Shield” in 2020, and “Safe Harbor” in 2015—on the basis that US protections were inadequate and not equivalent to the EU regime. 

The new data privacy framework sets in place more comprehensive obligations on companies compared to previous iterations and introduces several mechanisms of redress, including a newly implemented Data Protection Review Court (DPRC), which will independently investigate and resolve complaints.