GDPR · International transfers and adequacy decisions

Tracks the legality framework for international personal-data transfers from the EU: Article 45 adequacy decisions (adoptions, reviews and revocations), the EU-US Data Privacy Framework and its litigation (the Schrems saga, the Latombe case), Standard Contractual Clauses and Binding Corporate Rules as fallback mechanisms, and the U.S. factors conditioning the whole (PCLOB, FISA 702). Each entry documents the instrument, the court or authority, the effect on companies and the status. Deliberate boundary: fines for unlawful transfers —like Meta's 1.2 billion— live in 'sanciones-multas-digitales' and per-authority enforcement in 'gdpr-enforcement-by-country'; this tracker covers the question prior to any fine: on what legal basis can the data travel, and how firm is that basis today?

Snapshot · June 12, 2026

framework milestones documented

→ The EU-US DPF remains in force after surviving its first judicial challenge (Latombe, General Court, Sep 3, 2025), but appeal C-703/25 P is pending before the CJEU —the court that already struck down Safe Harbor and Privacy Shield—, the PCLOB is in legal limbo and FISA 702 runs on a short-term extension; the cross-cutting operational recommendation: keep SCCs as backup; Brazil is the most recent adequacy, adopted Jan 26, 2026 — the first major Latin American market with free data flow from the EU

Evolution

Documented events (6)

June 12, 2026 US confirmed

Status as of June 2026: the PCLOB in legal limbo and FISA 702 on a short-term extension — the DPF's two American pillars, under strain

The framework remains valid law, but its two American supports are under documented strain: the PCLOB —the oversight body reviewing the DPF's intelligence safeguards and consulted before DPRC judges' appointments— sits in legal limbo, and the European Commission has stated that restoring its full operational capacity is important for the framework's continued functioning; FISA Section 702, the legal basis for foreign surveillance, runs on a short-term extension while Congress debates renewal. The EDPB's first review acknowledged improvements but asked for more transparency on how the DPRC handles complaints and clarification on how agencies apply the proportionality standard. The Latombe ruling turned the Commission's continuous monitoring into the framework's legal safeguard — meaning the deterioration of these pieces is not just American politics: it is matter on which the adequacy's suspension can depend.

Recording Law — DPF guide 2026 (PCLOB crisis, FISA 702, revisión EDPB) ↗

October 31, 2025 EU confirmed

Latombe appeals to the CJEU (C-703/25 P): the DPF before the court that already demolished two frameworks

In October 2025, Latombe took the case up to the Court of Justice as Case C-703/25 P, now pending: the DPF stands before the same court that invalidated Safe Harbor and the Privacy Shield, and analysts agree an invalidation 'remains a distinct possibility'. The risk has grown costlier: the General Court's Bindl v. Commission doctrine opens the way to damages for unlawful transfers, so a third demolition would cost more than the previous two. NOYB, Max Schrems's organization, monitors the case and weighs a broader challenge of its own. The operative consequence, repeated by every law firm: anyone relying solely on the DPF should keep Standard Contractual Clauses as backup, because this bridge's history is the history of its collapses.

Recording Law — Latombe appealed to CJEU as C-703/25 P ↗ Berkeley Technology Law Journal — Third time's the charm? (Bindl y el coste de invalidar) ↗

September 3, 2025 EU confirmed

The General Court dismisses Latombe: the DPF survives its first trial under the essential-equivalence doctrine

On September 3, 2025, the General Court dismissed action T-553/23 and confirmed that the United States ensures an adequate level of protection: it found the DPRC sufficiently independent and impartial —its final, binding decisions satisfying Schrems II's essential-equivalence standard—, that U.S. law adequately limits bulk collection, and that GDPR-like sectoral protections exist in credit, employment, housing and insurance for automated decisions. Two principles of the ruling govern the future: adequacy requires not identical but substantially equivalent protection through potentially different means (para. 178), and the Commission continuously monitors the framework with the power to suspend, amend or repeal it if protection ceases to be ensured. It is the first measured judicial assessment that current safeguards suffice — after two failed attempts.

Epstein Becker Green — Adequacy of the DPF survives challenge ↗ Bird & Bird — What the Latombe decision means ↗ Hogan Lovells — GC upholds Data Privacy Framework ↗

July 10, 2023 EU confirmed

Third attempt: the Commission adopts the EU-US Data Privacy Framework adequacy, challenged within two months

On July 10, 2023, the European Commission adopted the EU-US Data Privacy Framework adequacy decision under GDPR Article 45: self-certified U.S. organizations may receive EU personal data without additional safeguards, with the new Data Protection Review Court (DPRC) as the redress mechanism —the piece whose absence killed the Privacy Shield—. The challenge came almost immediately: on September 6, 2023, Philippe Latombe —a French MP and CNIL commissioner, acting in a personal capacity— filed annulment action T-553/23 before the General Court, the framework's first direct judicial challenge, alleging the DPRC's lack of independence and the disproportionality of bulk intelligence collection.

Recording Law — DPF: complete guide 2026 ↗ Hogan Lovells — La acción de Latombe (T-553/23) ↗

July 16, 2020 EU confirmed

Schrems II strikes down the Privacy Shield: the second demolition defining the data bridge's structural fragility

On July 16, 2020, the CJEU invalidated the Privacy Shield (Schrems II), five years after striking down Safe Harbor (Schrems I, Case C-362/14, October 2015, in the wake of Snowden's mass-surveillance revelations): in both cases, the court found the U.S. Government's potential 'bulk' surveillance of transferred European data incompatible with EU law, and in Schrems II the decisive piece was the lack of an appropriate judicial redress mechanism. The double invalidation set the pattern governing everything since: transatlantic transfer frameworks are born under suspicion of judicial death, and companies learned never to depend on a single mechanism. It is the precedent against which every adequacy decision has been measured since.

Hogan Lovells — Transatlantic data transfers: GC upholds DPF (historia Safe Harbor/Privacy Shield) ↗ Recording Law — EU adequacy decisions: full country list ↗

January 26, 2026 BR confirmed

Brazil obtains EU adequacy: the first major Latin American market with free data flow

On January 26, 2026, the European Commission adopted the final adequacy decision for Brazil, following the draft published in September 2025 and a multi-year assessment: personal data may flow from the EU to Brazil without additional safeguards. The foundation is a decade of regulatory convergence: the LGPD mirrors the GDPR's structure and principles —lawful bases, data-subject rights, breach notification, data protection officers— and the ANPD, as an independent supervisory authority, issued the international-transfer and incident-notification regulations that completed the alignment. For Latin America it is the major precedent: adequacy stops being a Euro-Asian club (Japan, the UK, South Korea, with Uruguay and Argentina as regional antecedents) and demonstrates the route Chile, Colombia or Mexico can follow — with free data flow as a measurable competitive advantage for Brazil's tech and services industry.

Recording Law — EU adequacy decisions: Brazil adopted Jan 26, 2026 ↗

Methodology

Type: event-log
Construction: Multi-source verified
Cadence: event-driven

Sources consulted

Related pieces

Dónde viven los datos de América Latina: la soberanía digital y por qué la ubicación física dejó de importar — Juan D. Gonzáles