What is DPF?

DPF stands for the EU-US Data Privacy Framework — the framework that makes it lawful to send personal data from the EU to certified companies in the USA. It is the replacement for the earlier Privacy Shield, which was struck down by the EU Court of Justice in the so-called Schrems II ruling. DPF entered force in 2023 to plug the gap that then opened.

Think of DPF as an approved stamp. US companies can apply to be certified and then promise to handle Europeans' data under rules the EU considers sufficiently safe. If a company is on the list of certified participants, you as a European business can send data there without building a mass of your own extra agreements. If they are not on the list, the simplification does not apply.

DPF is therefore a way to make transatlantic data traffic simpler and lawful — but only for US companies that have actually certified themselves.

Why does DPF matter for your business?

If you use American cloud services or tools, DPF is often what makes the transfer lawful and straightforward. Checking whether your supplier is DPF-certified can save you both hassle and legal risk.

It gives you a secure, clear basis to stand on, instead of guessing whether your data transfer to the USA really holds up.

DPF in practice

A business that wants to use an American email tool can start by checking whether the supplier appears on the list of DPF-certified companies. If it does, the data transfer becomes much easier to justify lawfully.

At ZORC we help you check your suppliers' status and choose services that hold up legally, so you avoid unpleasant surprises.