+44 (0) 121 582 0192 [email protected]



2023 has significantly changed the data privacy landscape and international data transfers. The European Union and the United States have reached a significant milestone by adopting a new data privacy framework, further solidifying their commitment to safeguarding personal data. This framework, combined with the proposed UK extension to the EU data protection framework for UK-US data transfers, sets the stage for companies in adapting to the New EU-U.S. Data Privacy Framework 2023.

The New EU-U.S. Data Privacy Framework 2023 Adequacy Decision


The EU-U.S. Data Privacy Framework 2023 is a testament to the importance of cross-border data protection. This agreement, often called an “adequacy decision,” allows for the secure transfer of personal data from the European Union to the United States. The framework is built on principles emphasising solid data protection, transparency, and accountability, aligning with the EU’s stringent General Data Protection Regulation (GDPR).


Key provisions of the new EU-U.S. data privacy framework include:


  1. Redress Mechanisms: The framework establishes precise mechanisms for EU citizens to seek recourse in the U.S. if their data privacy rights are violated.
  2. Access to Data by U.S. Authorities: The agreement limits the ability of U.S. authorities to access European personal data for national security purposes, and access is now subject to safeguards and oversight.
  3. Obligations on U.S. Companies: U.S. companies receiving EU data must abide by specific obligations and commitments,
  4. Ombudsperson: The Data Privacy Framework will be overseen by an independent ombudsperson to address complaints.


Adapting to the New Framework


As companies deal with the new EU-U.S. Data Privacy Framework 2023 adequacy decision, several vital steps should be taken to ensure compliance:

  1. Update Privacy Notices: Companies transferring data to the U.S. should review and update their privacy notices to reflect the changes brought about by the new framework. This includes informing data subjects about the legal basis for data transfers, the recipients of their data, and their rights under the framework.
  2. Revise Data Processing Contracts: Review and revise data processing contracts, particularly for third-party vendors or processors in the U.S. These contracts should explicitly include the EU-U.S. Data Privacy Framework requirements to ensure that data is adequately protected.
  3. Employee Training: Ensure employees handling personal data know the new framework’s requirements. Training should cover data protection principles, data subject rights, and the company’s obligations under the adequacy decision.


The Proposed UK Extension


Data transfers from the UK to the U.S. have faced uncertainties with the UK’s exit from the EU. To address this, the UK has proposed an extension to the EU Data Protection Framework, allowing data transfers from the UK to the U.S. to be governed by the same inadequate decision. This alignment simplifies data transfers and strengthens the position of companies operating in both regions.




The new EU-U.S. Data Privacy Framework 2023 adequacy decision marks a positive step in the global effort to protect personal data while facilitating international data flows. Companies must adapt proactively to this framework by updating their privacy notices data processing contracts, and providing necessary employee training to ensure compliance.

The proposed UK extension to the EU data protection framework for UK-US data transfers further streamlines the international data transfer process. As companies navigate this evolving landscape, it is clear that data privacy is no longer an option but a fundamental requirement in today’s interconnected world. Adaptation is not just about compliance; it’s about building trust with customers and partners and ensuring a secure digital future.

US businesses can confirm their involvement in the EU-U.S. Data Privacy Framework by adhering to various privacy responsibilities. These may encompass privacy principles like restricting data usage to specific purposes, minimising data collection, and managing data retention, as well as precise obligations regarding data security and transmission to third parties.

U.S. Company Participation Certification

To avail themselves of the DPF advantages, U.S. companies must complete their participation certification by October 10, 2023. This procedure entails showcasing adherence to the privacy principles specified in the framework. Certification serves as an indicator of dedication to data privacy and has the potential to bolster an organization’s reputation regarding data protection.

The Data Privacy Framework registration website can be found here

EU and UK  data Controllers transfering personal data to the US when relying on the new data privacy framework need to ensure the US company receiving the personal data has indeed certified for the framework by visiting the Paticipant page found here 

Formiti Data International include the above work for their client registration and participant search in addition to privacy notice updates and reviewing policy and training courses.