Data transfers to the US have been a permanent issue for years. After the Court of Justice struck down Safe Harbor in 2015 and Privacy Shield in 2020, the Data Privacy Framework is the third attempt at a reliable framework. For Swiss and European companies using US cloud services it is today the most important mechanism.
How it works
US companies self-certify with the US Department of Commerce and commit to certain data protection principles. Certification is publicly visible in the DPF list. Adequacy applies only to certified companies and only to the data categories they are certified for. A US-based provider that is not certified is not covered.
EU and Switzerland
The European Commission adopted an adequacy decision for the EU-US DPF in July 2023. Switzerland added the US, for companies certified under the Swiss-US DPF, to its list of states with adequate data protection with effect from 15 September 2024. Important: for data from Switzerland the company must be certified explicitly for the Swiss-US DPF as well, not only for the EU-US part.
How to check a provider
Search the public DPF list for the company, check that certification is active and includes the Swiss-US DPF, and that it covers the relevant data, for example HR data too. Document the result with a date. For sub-processors, apply the same check at every level. Without certification, other safeguards such as standard contractual clauses are needed.
Which risks remain
The framework is legally contested. An action against the EU adequacy decision was dismissed by the General Court in September 2025; further proceedings are possible, and both predecessors failed. Anyone basing core systems solely on the DPF should know a plan B. Separately, the question remains whether US law such as the CLOUD Act allows access to data held by US groups in European data centres; the DPF answers the question of transfer, not of data residency.
In practice
For many standard tools the DPF is today a clean basis. For sensitive data or customers with high trust requirements, data residency in Switzerland or the EU with a provider without a US parent is the more robust choice. Our decision guide Swiss hosting or EU hosting weighs the options.