EU-US Data Privacy Framework: What It Means for Solo Freelancers — GDPR guide for solo freelancers

EU-US Data Privacy Framework: What It Means for Solo Freelancers

Bywarren_admin

Short answer: the EU-US Data Privacy Framework lets you send client personal data to US companies that have certified under it without signing extra transfer contracts, but its legal footing weakened sharply in 2026. Our verdict is USE WITH CAUTION: rely on it, and keep a backup mechanism ready. Status reviewed as of October 2026. The framework, adopted by the European Commission in July 2023, is the third attempt at a transatlantic data deal after Safe Harbor and Privacy Shield were both struck down by the EU’s top court. For a one-person business, it quietly decides whether your Gmail, Dropbox or AI assistant is a permitted home for an EU client’s data. A June 2026 US Supreme Court ruling on the independence of the Federal Trade Commission has reopened that question. Below is what the framework does, what it leaves out, and where the gaps sit, measured against our review methodology.

What the Data Privacy Framework does with your data

Privacy at a glance

Privacy dimensionThe Data Privacy Framework’s answer
Trains on your data?Not addressed; each vendor’s own policy decides
Training opt-outSet per vendor, never by the framework
Data retentionPurpose-limited; no fixed period in the principles
Third-party sharingOnward transfers need contracts with equal protection
Storage regionUnited States, at certified organizations only
Enterprise-team tierNo tiers; covers any certified company and data type
Legal status, October 2026Valid; CJEU appeal C-703/25 P still pending

What it is. The framework is not something you join as an EU freelancer. It is an adequacy decision: a finding by the European Commission, dated July 10, 2023, that US companies on a public list protect personal data to a standard comparable with EU rules (per the European Commission’s EU-US data transfers page, retrieved 2026-10-12). A US company gets on that list by self-certifying with the Department of Commerce, committing to a set of principles and renewing every year. Only organizations overseen by the Federal Trade Commission or the Department of Transportation can take part, which leaves out banks and most nonprofits.

What it covers. When your US vendor is listed and its certification covers the kind of data you send, the transfer needs no further paperwork. The principles require notice to the people concerned, limits on purpose, reasonable security, access and correction rights, and contracts that carry the same protection when data moves on to a subcontractor. A UK Extension and a separate Swiss-US framework apply the same logic to British and Swiss data.

What it leaves out. Certification says nothing about whether a vendor trains AI models on your prompts, how long it keeps your files or where its backups sit. Those answers live in each vendor’s own privacy policy and data processing agreement. A certified AI tool can still use consumer-plan content for model training if its terms allow it.

Who enforces it. Day-to-day enforcement rests on the FTC, and EU residents who suspect US intelligence access can complain to a Data Protection Review Court set up by a 2022 executive order. Both pillars took hits. The Privacy and Civil Liberties Oversight Board lost its quorum when three members were removed in January 2025 (per coverage in European MarTech, June 2, 2026). Then, on June 29, 2026, the Supreme Court held in Trump v. Slaughter that the president may dismiss FTC commissioners without cause (per analyses by Secure Privacy, August 4, 2026, and activeMind.legal, July 2, 2026). The noyb privacy group points out that the 2023 adequacy decision leans on FTC independence again and again.

What this means for solo freelancers

The framework was written with corporate legal teams in mind. For a one-person business it boils down to four exposures. Based on the framework as written and its status in October 2026, here is where each one bites.

Scenario 1: you are an EU freelancer using US tools. You keep an EU client’s customer list in Google Drive, draft their newsletters in a US AI assistant and bill them through a US accounting app. Each of those is an international transfer. If the vendor is on the official list for that data type, you have a recognized basis. If it is not, or its certification lapsed at renewal, you need standard contractual clauses (SCCs) in the vendor’s data processing agreement instead. Most freelancers never check, which leaves them with no documented basis on the day a client or regulator asks.

Scenario 2: you are a US freelancer with EU clients. The framework only covers data flowing to you if you certify yourself. Most solo consultants skip it, which is reasonable, but then you should expect EU clients to send SCCs or a processing agreement to sign. Our explainer on what a data processing agreement means for solo consultants walks through that negotiation clause by clause.

Scenario 3: Schrems III lands overnight. In July 2020 the EU Court of Justice invalidated Privacy Shield with immediate effect and no grace period. Two routes could repeat that outcome: the appeal by French MP Philippe Latombe, registered as Case C-703/25 P after the General Court sided with the Commission in September 2025 (per IAPP, September 3, 2025), and a fresh challenge that noyb announced on June 29, 2026. If either succeeds and the framework was your only basis, every US tool holding EU client data loses its footing on the same day.

Scenario 4: the AI blind spot. A vendor’s certification badge can make an AI tool look vetted. It is not a privacy rating. The framework governs the transfer, not what happens next, so a certified chatbot on a personal plan can still learn from the client brief you paste into it.

For the wider picture of EU work with American clients, read our guide to GDPR rules for EU freelancers working with US clients.

How to use it safely

You can keep using certified US tools today. The goal is to make sure a court ruling or a lapsed certification never leaves you without an answer. Work through this list once, then repeat the check every quarter:

  1. Look up every US vendor on the official list. Go to dataprivacyframework.gov, open the Data Privacy Framework List, search the company’s legal name and confirm its status reads Active. Check that coverage includes non-HR data, the category that client data falls into.
  2. Save dated proof. Print each listing to PDF and file it with the date. If a client asks why you chose a tool, you can show what was true at the time.
  3. Confirm the SCC fallback in each vendor agreement. Open the vendor’s data processing addendum and search for “Standard Contractual Clauses”. Large US providers usually build them in as a backup. If yours does not, treat that tool as a single point of failure.
  4. Keep a one-page transfer register. List each tool, what client data goes into it, the transfer basis (framework, SCCs or both) and the date you checked. A plain spreadsheet is enough.
  5. Turn off training in every AI tool you keep. Open the data controls or privacy settings and disable model improvement before any client material goes in.
  6. Move the most sensitive files to an EU or Swiss host. Contracts, ID scans, health and financial records are where an overnight ruling would hurt most.
  7. Name the mechanism in your client contracts. One sentence stating which tools you use and which transfer basis covers them heads off most client questions.
  8. Recheck after any court ruling. Set a quarterly calendar reminder, and run the full check again the week the Court of Justice rules on the Latombe appeal.

If a transfer does go wrong and client data ends up somewhere it should not, our guide to the 72-hour breach rule for freelancers explains who you owe a notice to and when.

Privacy-friendlier alternatives

None of these remove the need for a transfer register, but each takes a slice of client data out of the transatlantic question entirely. Quick picks:

  • Client email and file storage: Proton
  • Client passwords and admin logins: Bitwarden on its EU cloud region
  • Large deliverables shared with clients: Tresorit

Proton runs Mail, Drive, Calendar and Pass from Switzerland, a country the European Commission already treats as adequate, and encrypts stored content so that Proton itself cannot read it. What it gives you that a US office suite does not: client email and files that never depend on the Data Privacy Framework surviving in court. Proton Mail Plus starts around $5 per month, and the Proton Unlimited bundle costs around $13 per month. Best for consultants who handle contracts, ID documents or financial records for EU clients.

Bitwarden is an open-source password manager that lets you pick EU servers instead of US ones when you create your account. What it gives you: client logins, hosting credentials and shared vault items stored in Europe with end-to-end encryption. The free tier covers most solo needs, and Premium costs under $20 per year. Best for freelancers who hold admin access to client websites, ad accounts or domains.

Tresorit is a Swiss-owned file-sharing service with end-to-end encryption and data centers in Europe. What it gives you: encrypted client folders and expiring share links without a US cloud in the middle. Paid plans start in the low teens of dollars per user per month. Best for designers, translators and consultants who swap large files with clients every week.

A practical split works for most solo businesses: keep your everyday US suite for internal admin, and route the client folders that would hurt most in a Schrems III scenario through one of these three services.

The verdict

ATP Privacy-Vetted: USE WITH CAUTION

Use with caution: the EU-US Data Privacy Framework is still a valid basis for sending client data to certified US tools in October 2026, but it should never be your only one. The adequacy decision stands and the General Court upheld it in September 2025, yet the FTC independence it relies on was undercut in June 2026, a Court of Justice appeal is pending and noyb has announced a new challenge. Check every vendor on the official list, confirm standard contractual clauses sit in each processing agreement as a fallback, and keep your most sensitive client files with an EU or Swiss host.

Frequently asked questions

Is the EU-US Data Privacy Framework still valid in October 2026?

Yes. The European Commission’s adequacy decision from July 2023 remains in force, and the EU General Court rejected Philippe Latombe’s challenge on September 3, 2025. That ruling is under appeal at the Court of Justice as Case C-703/25 P, with no hearing date reported as of August 2026. The noyb group has also announced its own challenge after the Supreme Court’s FTC ruling. Valid today, but not guaranteed next year.

Does a DPF certification make a US AI tool GDPR-friendly?

Only partly. Based on the framework as written, certification gives you a recognized basis for transferring personal data to that company. It does not settle how the vendor uses the data afterwards: training on prompts, retention periods and subprocessors are all set by its own terms. You still need a processing agreement, a lawful reason to handle the data and a check of the tool’s training settings before client material goes in.

Do I need to self-certify as a US freelancer with EU clients?

No, participation is voluntary. Self-certifying lets EU clients send you personal data without extra contracts, but it brings an annual fee, a published privacy policy, an independent recourse mechanism and yearly recertification under FTC oversight. Most solo consultants find it simpler to sign standard contractual clauses with each EU client. Certification starts to pay off only if you regularly receive EU personal data from many clients.

What happens to my client data if the DPF is struck down?

When Privacy Shield fell in July 2020, transfers relying on it lost their legal basis immediately, with no transition period. A similar ruling would leave any US tool covered only by this framework without a valid basis. Vendors whose processing agreements already include standard contractual clauses would switch to them, though you would still need to reassess the risk. That is why checking the SCC fallback now matters.

Does the DPF cover UK and Swiss client data?

Through separate add-ons. The UK Extension lets certified US companies receive British personal data, and the Swiss-US framework does the same for Switzerland. A company has to opt into each one, so check the vendor’s listing for UK and Swiss coverage rather than assuming its EU certification carries over. If your client is British or Swiss, confirm the right entry on the official list before moving their data.

Sources

Reviewed by Jérémy, founder of AidTaskPro and GreenBudgetHub. Based in central France. Privacy posture sourced from public policies and vendor documentation as of October 12, 2026.

Get Your Free Cybersecurity Checklist

Protect your digital life in 5 minutes. Free checklist + weekly productivity & security tips.

Similar Posts