# Information note on data transfers under the GDPR to the United States after the adoption of the adequacy decision on 10 July 2023

- Type: Guidance
- Source: EDPB
- Identifier: information-note-on-data-transfers-under-the-gdpr-to-the-united-states-en
- Date: 2023-07-18
- Original: https://www.edpb.europa.eu/documents/other-guidance/information-note-on-data-transfers-under-the-gdpr-to-the-united-states_en
- Canonical: https://overview.legal/posts/125835
- Topics: Codes of Conduct, Processing Agreement, International Transfer, Privacy Shield, Supervisory Authorities, Personal Data, Processing

## Summary

1 Adopted Information note on data transfers under the GDPR to the United States after the adoption of the adequacy decision on 10 July 2023 On 10 July 2023, the European Commission (‘the Commission’) adopted its Implementing Decision of 10.7.2023 pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council on the adequate level of protection of personal data under the EU-US Data Privacy Framework (‘the Adequacy Decision’) 1 , which contains in its annex the EU-US Data…

## Sections (13)

### ¶1

Adopted Information note on data transfers under the GDPR to the United States after the adoption of the adequacy decision on 10 July 2023 On 10 July 2023, the European Commission (‘the Commission’) adopted its Implementing Decision of 10.7.2023 pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council on the adequate level of protection of personal data under the EU-US Data Privacy Framework (‘the Adequacy Decision’) 1 , which contains in its annex the EU-US Data Privacy Framework (‘DPF’). By doing so, the Commission decided that the United States (‘the US’), for the purpose of Article 45 of Regulation (EU) 2016/679 (‘the GDPR’), ensures an adequate level of protection for personal data transferred from the EU 2 to organisations in the US that are included in the ‘Data Privacy Framework List’, maintained and made publicly available by the U.S. Department of Commerce, in accordance with Section I.3 of Annex I of the Adequacy Decision 3 . Prior to the adoption of this decision, the European Data Protection Board (‘the EDPB’) adopted its opinion on the draft Adequacy Decision 4 , in compliance with Article 70(1)(s) GDPR. This document aims at providing some clarity on the implications of the Adequacy Decision for data subjects in the EU and for entities transferring personal data from the EU to the US. 1.- How can personal data be transferred to the US on the basis of the DPF? The Adequacy Decision applies since 10 July 2023. This means that, as of this date, transfers from the EU 5 to organisations in the US that are included in the ‘Data Privacy Framework List’ 6 may be based on the Adequacy Decision, without the need to rely on Article 46 GDPR transfer tools. 1 Commission Implementing Decision of 10.7.2023 pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council on the adequate level of protection of personal data under the EU-US Data Privacy Framework, C(2023) 4745 final.

### ¶2

References to the ‘EU’ must be understood as references to the EEA/EU.

### ¶3

Article 1 of the Adequacy Decision.

### ¶4

Opinion 5/2023 on the European Commission Draft Implementing Decision on the adequate protection of personal data under the EU-US Data Privacy Framework. Adopted on 28 February 2023, https://edpb.europa.eu/system/files/2023-02/edpb opinion52023 eu-us dpf en.pdf .

### ¶5

This means that the Adequacy Decision does not cover transfers from entities located outside the EU and subject to the GDPR by virtue of Article 3(2) GDPR to organisations in the US that are included in the ‘Data Privacy Framework List’. 6 https://www.dataprivacyframework.gov/s/participant-search . 2 Adopted This also means that transfers based on the Adequacy Decision do not have to be complemented by supplementary measures 7 . The EDPB refers to the explanations provided on this matter by the Commission 8 . 2.- How can personal data be transferred to the US if the data importer is not included in the ‘Data Privacy Framework List’? Transfers to entities in the US which are not included in the ‘Data Privacy Framework List’ cannot be based on the Adequacy Decision and will require appropriate data protection safeguards, enforceable rights and effective legal remedies for data subjects (e.g. through standard data protection clauses, binding corporate rules), in accordance with Article 46 GDPR 9 . In this respect, the EDPB underlines that all the safeguards that have been put in place by the US Government in the area of national security (including the redress mechanism) apply to all data transferred to the US, regardless of the transfer tool used 10 . Therefore, when assessing the effectiveness of the Article 46 GDPR transfer tool chosen 11 , data exporters should take into account the assessment conducted by the Commission in the Adequacy Decision 12 . 3.- Can data subjects in the EU lodge complaints under the DPF? Individuals whose data are transferred to the US based on the Adequacy Decision have several redress mechanisms at their disposal if they consider that the US organisation concerned does not comply with the DPF 13 . Individuals are encouraged to first raise any complaint they may have with the relevant US organisation. In case of inquiries, EU organisations may, if necessary, seek the advice of their data protection authorities that are competent to oversee the related processing activities. 4 How can EU data subjects make use of the new redress mechanism in the area of national security? Regardless of the transfer tool used to transfer their personal data to the US, data subjects in the EU can submit a complaint to their national data protection authority to make use of the new redress mechanism in the area of national security. The national data protection authority, in turn, will ensure that the complaint will be handed over to the EDPB, which will transmit the complaint to the US authorities that are competent to handle the complaint. Furthermore, the data protection authority will ensure that the data subject is provided information regarding the complaint handling process, including with regard to the outcome of the lodged complaint. For a complaint to be admissible,

### ¶7

See EDPB Recommendations 01/2020 on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data, paragraph 19: https://edpb.europa.eu/system/files/2021- 06/edpb recommendations 202001vo.2.0 supplementarymeasurestransferstools en.pdf .

### ¶8

See the Commission’s press release ( https://ec.europa.eu/commission/presscorner/detail/en/ip 23 3721 ) and Q&A ( https://ec.europa.eu/commission/presscorner/detail/en/qanda 23 3752 ).

### ¶9

See EDPB Recommendations 01/2020 on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data, https://edpb.europa.eu/system/files/2021- 06/edpb recommendations 202001vo.2.0 supplementarymeasurestransferstools en.pdf

### ¶10

See also https://ec.europa.eu/commission/presscorner/detail/en/qanda 23 3752 .

### ¶11

See EDPB Recommendations 01/2020 on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data, paragraph 30: https://edpb.europa.eu/system/files/2021- 06/edpb recommendations 202001vo.2.0 supplementarymeasurestransferstools en.pdf .

### ¶12

See in particular, recitals (6)-(7) of the Adequacy Decision.

### ¶13

The redress mechanisms are described in the Adequacy Decision, Annex I, Section II.7 and III. 11 and Annex I to Annex I. 3 Adopted individuals do not need to demonstrate that their data was in fact collected by US intelligence agencies. 5.- Will the Adequacy Decision be reviewed? The first review of the Adequacy Decision will take place one year after it enters into force, to verify whether all elements have been fully implemented and effective in practice. Following the first review and depending on its outcome, the Commission will decide, in consultation with the EDPB and the EU Member States, on the periodicity of subsequent reviews, which will in any event take place at least every four years 14 . The EDPB and its members stand ready to actively take part in this evaluation. For the European Data Protection Board The Chair (Anu Talus)

### ¶14

Article 3(4) of the Adequacy Decision.

---
Generated by overview.legal · https://overview.legal/posts/125835 · 2026-07-17