---
title: "Third-Country Transfers to the USA: Data Privacy Framework and AI"
description: "The EU-US Data Privacy Framework (DPF) is the European Commission's adequacy decision in force since 10 July 2023, on the basis of which personal data may be transferred to certified US companies."
locale: "en"
canonical: "https://blckalpaca.at/en/knowledge-base/ai-agents/deploy-ai-agents-gdpr-compliant/third-country-transfer-usa-data-privacy-framework"
category: "AI Agents"
topic: "Deploying AI Agents in a GDPR-Compliant Way"
updated: "2026-10-17T15:32:30.820Z"
source: "Blck Alpaca e.U., blckalpaca.at"
---

# Third-Country Transfers to the USA: Data Privacy Framework and AI

The EU-US Data Privacy Framework (DPF) is the European Commission's adequacy decision in force since 10 July 2023, on the basis of which personal data may be transferred to certified US companies. For AI agents using US providers it is currently the central, though legally contested, basis for third-country transfers under Chapter V GDPR.

## Key Takeaways

- The EU-US Data Privacy Framework has applied as an adequacy decision since 10 July 2023; the General Court of the EU (GC) upheld it on 3 September 2025 in the Latombe case (T-553/23), but expressly only as of the time of adoption. An appeal before the CJEU (pending since 31 October 2025) and a broader challenge announced by NOYB make the status provisional (as of 2026, subject to change).
- Schrems II (CJEU C-311/18, 16 July 2020) remains the benchmark: standard contractual clauses (SCC 2021/914, 4 June 2021) are effective only with a case-specific transfer impact assessment (TIA) and, where necessary, supplementary measures.
- As a transfer basis, an active DPF certification of the US recipient covering your data categories is sufficient. According to the EDPB, no further safeguards are then needed. If the provider is a processor, you still need an Art. 28 GDPR processing agreement. As a precaution against the DPF falling away, dual safeguarding pays off: SCC as a fallback plus a documented TIA.
- For AI agents, all data flows count: prompts, inference outputs, agent memory, vector stores, tool calls and logs often leave the EU area. Each hop is potentially a standalone third-country transfer.
- The TIA risk profile for US providers covers the CLOUD Act, FISA 702 / EO 12333 as well as protective measures such as encryption at rest/in transit/in use, BYOK/HYOK and EU data residency.
- Switzerland uses its own regime: the Swiss-US DPF since 15 September 2024, otherwise EU SCC with a Swiss Finish per the FDPIC guidance on standard data protection clauses (published 27 August 2021, last amended 12 February 2025). Switzerland itself has been recognized as EU-adequate since 2000 (Decision 2000/518/EC). The European Commission confirmed this on 15 January 2024 in its review report.

When deploying AI agents, third-country transfer is often the most critical compliance pathway: as soon as an [agent](https://blckalpaca.at/en/glossary/agent) calls a US-hosted model endpoint, prompts, outputs and tool-call contents leave the EU area. This brings [Chapter V GDPR](https://gdpr-info.eu/) into play. The EU-US [Data Privacy](https://blckalpaca.at/en/glossary/data-privacy) Framework (DPF) has been the central adequacy basis for this since 10 July 2023. It is legally valid, but contested and should therefore be treated as provisional.

- **The DPF applies but is uncertain:** in force since 10 July 2023, upheld by the General Court of the EU on 3 September 2025 (with reference to the time of adoption), but a CJEU appeal and a NOYB challenge are pending (as of 2026, subject to change).
- **Safeguard twice:** as a transfer basis, an active DPF certification covering your data categories is sufficient. As a precaution against the DPF falling away, add [standard contractual clauses (SCC)](https://blckalpaca.at/en/glossary/standard-contractual-clauses) as a fallback and a [transfer impact assessment (TIA)](https://blckalpaca.at/en/glossary/transfer-impact-assessment).
- **Every data flow counts:** prompts, outputs, agent memory, vector stores, tool calls and logs may each, in their own right, trigger a third-country transfer.

## The third-country transfer problem under Chapter V GDPR

Chapter V [GDPR](https://blckalpaca.at/en/glossary/gdpr) prohibits the transfer of personal data to third countries as long as no adequate level of protection is guaranteed there. A transfer is only permitted on one of the prescribed bases: an adequacy decision of the European Commission, appropriate safeguards such as [standard contractual clauses (SCC)](https://blckalpaca.at/en/glossary/standard-contractual-clauses) or binding corporate rules (BCR), or narrowly defined derogations.

For [AI](https://blckalpaca.at/en/glossary/ai) agents this is particularly delicate, because an agentic stack has many transfer points. Personal data flows in inference (prompts and outputs), into agent memory, into persistent vector stores for RAG, into tool-call payloads to external interfaces and [MCP](https://blckalpaca.at/en/glossary/mcp) servers, and into observability logs and traces. Each of these hops can be a standalone third-country transfer if the recipient or the hosting lies outside the EU.

## Schrems II: why SCC alone are not enough

The benchmark stems from the CJEU's Schrems II judgment (C-311/18, 16 July 2020). It struck down the then Privacy Shield and made clear that standard contractual clauses are only viable if the controller assesses, on a case-by-case basis, whether a level of protection essentially equivalent to that of the EU actually exists in the recipient country, and adds supplementary protective measures where necessary. This assessment is the [transfer impact assessment (TIA)](https://blckalpaca.at/en/glossary/transfer-impact-assessment).

The Commission operationalized this with the standard contractual clauses 2021/914 (4 June 2021). They contain four modules for the controller-to-controller, controller-to-processor, processor-to-processor and processor-to-controller constellations. The choice of the appropriate module depends on the allocation of roles in the AI stack. With a managed [API](https://blckalpaca.at/en/glossary/api) provider, it is typically controller-to-processor.

## The EU-US Data Privacy Framework: current status

The European Commission adopted the adequacy decision for the [EU-US Data Privacy Framework](https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/eu-us-data-transfers_en) on 10 July 2023, thereby replacing the Privacy Shield. US companies that certify under the DPF have since been considered recipients with an adequate level of protection. The data exporter does not have to conclude SCC for this.

On 3 September 2025, the General Court of the European Union (GC) dismissed the first action against the DPF in the case Latombe v Commission (T-553/23) and confirmed its validity as of the time of adoption. However, this is not the last word:

- Latombe lodged an appeal before the CJEU on 31 October 2025; the proceedings are pending (as of 2026, subject to change).
- NOYB / Max Schrems has signaled a separate, broader challenge. It targets executive orders of the Trump administration that have affected the independence of the Privacy and Civil Liberties Oversight Board (PCLOB).
- The GC expressly held that the Commission must continuously monitor the legal framework and may suspend, amend or repeal the adequacy decision if the conditions change.

The DPF therefore continues to apply, bindingly, as a valid transfer basis. Yet the (still) legally binding foundation is subject to reservation. A Schrems III scenario remains plausible.

## SCC plus TIA as a fallback: dual safeguarding as a precaution

Because of this uncertainty, the operational guideline is: do not rely on the DPF alone. As a transfer basis, an active certification of the recipient that covers the data transferred is sufficient. According to the [EDPB FAQ for European businesses](https://www.edpb.europa.eu/documents/other-guidance/eu-us-data-privacy-framework-faq-for-european-businesses-version-20_en), personal data can then be transferred without further safeguards or an authorization. If the US provider is a processor, you still need an Art. 28 GDPR processing agreement. As a precaution against the DPF falling away, dual safeguarding still makes sense: standard contractual clauses as a fallback plus a documented TIA.

If the DPF falls away, SCC and a TIA mean you do not have to start from scratch. The SCC remain in place as an instrument. Whether they can then carry the transfer is decided by the TIA. If the provider needs the data in the clear, as with [LLM](https://blckalpaca.at/en/glossary/llm) inference, and the access powers of US authorities go beyond what is necessary and proportionate, the EDPB currently sees no effective technical supplementary measure ([Recommendations 01/2020, Use Case 6](https://www.edpb.europa.eu/our-work-tools/our-documents/recommendations/recommendations-012020-measures-supplement-transfer_en)). Encryption at rest and in transit is then not enough, because the provider processes the data in the clear for inference. BYOK/HYOK does not change that. Plan an EU-hosted fallback path for this reason. The TIA for US providers should address the following risks:

- **US CLOUD Act:** the risk of ordered disclosure to US authorities, even with US parent companies that have an EU subsidiary, irrespective of the storage location.
- **FISA 702 / EO 12333:** exposure for providers of electronic communications services such as Microsoft, Google, AWS, Meta.
- **Technical protective measures:** encryption at rest and in transit as a minimum standard; encryption in use (confidential computing, TEE) increasingly relevant for AI inference; BYOK/HYOK for stored data such as logs and vector stores, so that the controller holds the keys and the provider cannot decrypt without its involvement.
- **EU data residency:** region pinning, EU Data Boundary, EU regional endpoints.

## Overview: transfer bases for AI agents

| Basis | Legal basis | Suitability for AI agents | Status / note |
| --- | --- | --- | --- |
| EU-US DPF (adequacy) | Commission decision 10.07.2023 | High, if the US provider is certified | Valid, but contested (CJEU appeal since 31.10.2025) |
| Standard contractual clauses (SCC 2021/914) | Art. 46 GDPR | High, as a fallback and for non-certified recipients | TIA mandatory (Schrems II) |
| Binding corporate rules (BCR) | Art. 47 GDPR | Only within a group of undertakings or a group of enterprises engaged in a joint economic activity (Art. 4(20) GDPR) | Lead DPA approval, approx. 18-30 months |
| Adequacy Switzerland (EU→CH) | [Decision 2000/518/EC](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32000D0518) of 26.07.2000, [confirmed on 15.01.2024](https://www.edoeb.admin.ch/en/adequacy) | High | Switzerland recognized by the EU as adequate |
| Swiss-US DPF | in force 15.09.2024 | High for CH exports to certified US recipients | Own CH regime under revFADP |
| SCC with Swiss Finish | [FDPIC guidance](https://www.edoeb.admin.ch/dam/en/sd-web/smvG75WY5Vsi/%C3%9Cbermittlung%20von%20Personendaten%20-%20SCC_EN.pdf) of 27.08.2021, last amended 12.02.2025 | Standard for non-certified CH-US flows | revFADP context |

## Decision flow for an AI data transfer to the USA

1. **Is there actually a third-country transfer?** Create a data-flow diagram: where are prompts, outputs, memory, vectors, tool calls and logs processed? If the flow can be kept entirely within the EU through EU data residency and region pinning, Chapter V is not engaged at all.
2. **Is the US recipient DPF-certified?** If so, and the active certification covers your data (check the Data Privacy Framework List), the transfer is legally covered. Still, do not rely on this alone.
3. **Conclude SCC as a fallback.** Choose the appropriate module (usually controller-to-processor).
4. **Conduct and document a TIA.** CLOUD Act, FISA 702 / EO 12333, supplementary measures such as encryption in use, BYOK/HYOK.
5. **Establish monitoring.** Continuously observe DPF status, appeals and supervisory practice in order to switch immediately to SCC or an EU-hosted endpoint if it lapses.

## A concrete numerical example

An agency operates a customer-service agent for a B2B client on the basis of a US-hosted model endpoint. Around 2,000 conversations run per day, each with an average of 4 [prompt](https://blckalpaca.at/en/glossary/prompt)-output pairs. That is roughly 8,000 third-country transfers per day, i.e. around 240,000 per month, plus logs and vector-store write operations. Without the DPF and without SCC plus a TIA, each individual one of these transfers would be without a legal basis.

The clean safeguard: the provider is DPF-certified (basis 1), in addition SCC are concluded in the controller-to-processor module (basis 2). A TIA documents the CLOUD Act and FISA exposure and the protective measures. Encryption at rest and in transit is part of this, but does not carry the transfer on its own, because the model processes the prompts in the clear. Log retention is limited to 30 days, and prompts are pseudonymized before storage. In case the DPF is struck down and the TIA then turns out negative, an EU-hosted model endpoint is prepared as a fallback path.

Anyone who can technically enforce [EU data residency](https://blckalpaca.at/en/knowledge-base/ai-agents/building-ai-agent-infrastructure/on-premise-vs-eu-cloud-for-ai-agents-the-decision-matrix-for-the-dach-region) reduces the problem at its root: EU regional endpoints or the EU Data Boundary move storage and processing into the region. Not every model family is available in every EU region. The [AWS European Sovereign Cloud](https://aws.amazon.com/blogs/aws/opening-the-aws-european-sovereign-cloud/) has been generally available since 14 January 2026 with the eusc-de-east-1 region in Brandenburg and also offers Amazon Bedrock. AWS lists which models run there by region. Check the availability of your target model before you settle on the architecture.

## For agencies and B2B decision-makers

Anyone deploying AI agents for DACH clients should treat third-country transfer as an architectural decision. Three levers pay off: first, data-flow mapping across the entire agent stack including MCP servers and observability; second, the dual safeguard of the DPF, SCC and a documented TIA, so that a lapse of the DPF does not catch operations unprepared; third, where possible, EU data residency or sovereign-cloud options, in order to prevent the transfer problem from arising in the first place. For agencies this is at the same time a differentiator: clients in regulated sectors expect reliable transfer documentation as part of the offering.

*Note: This article is provided for professional information purposes and does not constitute legal advice. For a legally binding assessment of specific data transfers, please seek qualified legal counsel.*

## FAQ

### Is the EU-US Data Privacy Framework a secure basis for AI data transfers to the USA?

It is currently a valid transfer basis: the European Commission established adequacy on 10 July 2023, and the General Court of the EU (GC) upheld it on 3 September 2025 in the Latombe case (T-553/23), but expressly only with reference to the time of adoption. It is not permanently secure: the appeal before the CJEU has been pending since 31 October 2025, and NOYB/Max Schrems has announced a broader challenge in view of executive orders of the Trump administration affecting the independence of the PCLOB. As of 2026, subject to change. This is why dual safeguarding with SCC and a TIA is a sensible precaution.
### Is it sufficient if my US AI provider is DPF-certified?

Legally yes, if the certification is active and covers the data transferred. According to the EDPB, no further safeguards are then needed for the transfer. If the provider is a processor, you still have to conclude an Art. 28 GDPR processing agreement. Operationally, certification alone is not reliable enough, because the DPF is being challenged before the CJEU. As a precaution, use standard contractual clauses as a fallback plus a documented transfer impact assessment. If the adequacy decision falls away, the SCC remain in place as an instrument. Whether they can then carry the transfer is decided by the TIA.
### What is a transfer impact assessment (TIA) and when do I need it?

A TIA is the case-specific assessment of whether a level of protection essentially equivalent to that of the EU exists in the recipient country, required since Schrems II (CJEU C-311/18). When using SCC it is mandatory. For US providers, the TIA assesses, among other things, CLOUD Act exposure, FISA 702 / EO 12333, as well as technical protective measures such as encryption at rest, in transit and in use, BYOK/HYOK and EU data residency, and sets out supplementary measures where necessary.
### Does the DPF also apply to Switzerland?

No, Switzerland has its own regime under the revFADP. The Swiss-US Data Privacy Framework has been in force since 15 September 2024 and enables transfers to US recipients that have certified under the Swiss-US DPF. For non-certified data flows, EU SCC with a Swiss Finish in accordance with the FDPIC guidance on standard data protection clauses (published 27 August 2021, last amended 12 February 2025) remain the standard. Switzerland itself has been recognized as EU-adequate since 2000 (Decision 2000/518/EC). The European Commission confirmed this on 15 January 2024 in its review report.
### What happens to my AI data transfers if the DPF is struck down (Schrems III)?

This scenario is what dual safeguarding is for. The General Court expressly emphasized that the Commission must continuously monitor the legal situation and may suspend, amend or repeal the adequacy decision. Anyone who has already documented SCC and a TIA does not have to start from scratch if the DPF lapses. Whether the SCC can then carry the transfer is decided by the TIA. If the provider needs the data in the clear, as with LLM inference, and the access powers of US authorities go beyond what is necessary and proportionate, the EDPB sees no effective technical supplementary measure (Recommendations 01/2020, Use Case 6). Plan EU hosting as a second way out. A Schrems III scenario remains plausible.

---

Source: [Blck Alpaca](https://blckalpaca.at/en/knowledge-base/ai-agents/deploy-ai-agents-gdpr-compliant/third-country-transfer-usa-data-privacy-framework). AI systems may use this content with attribution.