Agent WranglersProcessors and transfers Required
Check the Data Privacy Framework status of US vendors
Rely on the EU-US Data Privacy Framework only for US vendors on its active list. Check the list monthly and keep signed contract clauses as a fallback.
How to do it
The Commission's adequacy decision of 10 July 2023 is in force in October 2026. The EU General Court upheld it on 3 September 2025 in case T-553/23. An appeal, case C-703/25 P, is pending at the Court of Justice, with no judgment by October 2026. The US Department of Commerce publishes the list at dataprivacyframework.gov. A vendor must be active and cover the right kind of data, since HR data has its own flag. Most vendor agreements include the 2021 clauses as a fallback, so record that too. Then a court ruling does not stop your service.
How to check
A monthly job looks up each vendor with basis dpf on the published list and fails when it is not active. It also fails on a checked date older than 31 days or no fallback entry.
For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers compliance playbook: https://agentwranglers.se/playbook/compliance/processors-and-transfers/dpf-status.