BBB National Programs

Data Privacy Framework Progress

The Data Privacy Framework (DPF) Program is now in effect, replacing Privacy Shield as the mechanism to allow the safe, seamless transfer of personal data from the EU to the U.S in compliance with EU law. This timeline documents the milestones in this journey since Privacy Shield was invalidated in July 2020.


  • Podcast: Privacy Abbreviated host Dona Fraser is joined by IAPP’s Cobun Zweifel-Keegan to break down the launch of the DPF program. Listen Now
  • Ready for a consultation with our Global Privacy Division to learn more about joining the Data Privacy Framework Program? Sign up here.
  • Have questions specific to the transition from Privacy Shield to the Data Privacy Framework? Contact us at




Jump to: 2020 | 2022 | 2023

Most Recent Developments


July 17

The Department of Commerce launched the EU-U.S. Data Privacy Framework Program website.


Learn More

Apply for DPF Services


July 10

The European Commission adopted its adequacy decision for the EU-U.S. Data Privacy Framework.


Learn More

Read Our Statement


July 7

24 out of 27 EU Member States voted in favor of the EU-U.S. Data Privacy Framework indicating that the DPF provides an adequate level of protection for personal data.


Learn More


July 3

The U.S. Department of Justice and the Office of the U.S. National Intelligence Director announced that all commitments under Executive Order 14086 have been fulfilled.


Learn More


June 8

UK and US reach commitment to establish a UK Extension to the Data Privacy Framework, creating a “data bridge” for cross-border data transfers between the two countries.


Learn More


May 22

Irish DPC finds Meta's use of SCCs insufficient, highlighting the urgent need for the EU-U.S. Data Privacy Framework.


Learn More


May 11

MEPs adopt a Resolution rejecting the EU-U.S. Data Privacy Framework.


Press Release

Adopted Resolution


April 12

Members of EU Parliaments (MEPs) call for renegotiation of EU-U.S. Data Privacy Framework.


Learn More


February 28

The European Data Protection Board (EDPB) released its non-binding opinion of the EU Commission’s draft adequacy decision welcoming “substantial improvements” while expressing concerns and requesting further clarification on several points.


EDPB Statement

IAPP Article


February 14

The European Parliament released a non-binding draft opinion urging the EU Commission to not adopt its draft adequacy determination and continue negotiations.


Learn More


January 11

The International Trade Administration (ITA), U.S. Department of Commerce published FAQs 1-7 for the EU-U.S. Data Privacy Framework.


Learn More





December 13

The Office of the Director of National Intelligence (ODNI) issued Intelligence Community Directive 126 implementing procedures for the Signals Intelligence Redress Mechanism required by the October 7 Executive Order.


ODNI Statement

ODNI Procedures


The EU Commission released a draft adequacy determination.


EU Commission Statement

EU Commission Decision


October 7

The U.S. Department of Justice signed regulations establishing a review court required by the October 7 Executive Order.


Learn More


President Biden signed an Executive Order that would serve as the legal basis for an adequacy determination.


Read Our Blog



Read the Executive Order


March 25

The EU and U.S. announce an agreement, in principle, on a new Trans-Atlantic Data Privacy Framework.


Read Our Blog



EU-U.S. Joint Statement





July 16

Schrems II invalidated Privacy Shield.


Learn More