---
title: The EU-US Data Privacy Framework Was Just Approved. Why Are Some Companies Avoiding It?
description: Learn why some companies are avoiding the EU-US Data Privacy Framework, and explore how to strengthen privacy for cross-border data transfers.
image: https://shardsecure.com/hubfs/Financial%20paper%20charts%20and%20graphs%20on%20the%20table.jpeg
---

- [Home](https://shardsecure.com/)
- [Blog](https://shardsecure.com/blog)

# The EU-US Data Privacy Framework Was Just Approved. Why Are Some Companies Avoiding It?

![Picture of ShardSecure](https://shardsecure.com/hubfs/ShardSecure%20brand%20assets/Logo%20(2022)/Profile/ShardSecure-Logo__Profile--Purple-Inverted.svg "Picture of ShardSecure")

[ShardSecure](https://shardsecure.com) 

 August 11 2023 

![White hands point to graphs and charts to signify companies avoiding the new EU-US Data Privacy Framework](https://shardsecure.com/hubfs/Financial%20paper%20charts%20and%20graphs%20on%20the%20table.jpeg "White hands point to graphs and charts to signify companies avoiding the new EU-US Data Privacy Framework")

The EU-US Data Privacy Framework Was Just Approved. Why Are Some Companies Avoiding It?

After three years of negotiations, the EU [gave final approval](https://www.wsj.com/articles/eu-approves-data-transfer-deal-with-u-s-averting-potential-halt-in-flows-7a149c9?mod=article_inline) in July to a new deal that allows companies to store European personal data on US soil. The deal, known as the EU-US Data Privacy Framework, offers a framework to facilitate cross-border data transfers while protecting individuals’ data privacy.

It’s been a slow process — three years in the making  — to reach this point. So why are some companies holding back from adopting the new data agreement?

## What is the EU-US Data Privacy Framework?

First, let’s understand what the framework involves. Also known as the Trans-Atlantic Data Privacy Framework, the EU-US Data Privacy Framework is an agreement designed to facilitate the free flow of data between countries. 

Originally announced in October 2022 with an executive order from the President of the United States, the framework offers a comprehensive set of guidelines to protect individual privacy rights in data transfers across the Atlantic. In it, the US outlines data privacy procedures that are essentially equivalent to the EU’s own procedures in the General Data Protection Regulation (GDPR).

The framework was developed in response to the Schrems II ruling (c-311/18), a landmark data privacy case brought by Austrian privacy activist Max Schrems. In 2020, Schrems II invalidated the EU-US Privacy Shield, an earlier agreement designed to facilitate EU-US data transfers under the GDPR. Ever since then, companies subject to the GDPR have had to use lengthy legal contracts and supplementary safeguards to transfer data to the US.

Now, the [newly approved EU-US Data Privacy Framework](https://ec.europa.eu/commission/presscorner/detail/en/qanda_23_3752) aims to replace the old Privacy Shield and establish a secure and transparent mechanism for organizations to transfer personal data under the GDPR. It is designed to not only facilitate seamless data sharing for businesses but also safeguard people’s personal information, bolstering cross-border trade while upholding fundamental privacy concerns.

## Why are some companies avoiding the Data Privacy Framework?

According to the US Commerce Department — which last month [released a new Data Privacy Framework website](https://www.commerce.gov/news/press-releases/2023/07/data-privacy-framework-program-launches-new-website-enabling-us) for US companies to self-certify their compliance — around 2,500 companies have signed up to the new framework so far. That’s only a small fraction of the companies eligible to use the framework. So why are companies holding back?

For some, it’s because they’re waiting to see whether the benefits outweigh the risks. For others, it’s a question of learning from Schrems II and waiting to see if this new agreement is also struck down in court. Below, we’ll dig into several of the top reasons that companies are hesitating to adopt the new framework.

### Organizations have already established their own data privacy frameworks

The EU-US Data Privacy Framework has been a long time in the making, and three years have passed since Schrems II. In that time, organizations that process EU personal data have had to implement their own data privacy measures to comply with the GDPR.

As a [*Wall Street Journal* article](https://www.wsj.com/articles/some-companies-shun-long-awaited-trans-atlantic-data-agreement-aa8c7514) reports, many of these organizations are now choosing to stick with these existing data privacy practices. Some companies are just accustomed to the contractual clauses and technical safeguards they’ve been using in lieu of an official framework; others have made more permanent changes like switching from American to European technology providers.

### Organizations fear the increased regulatory burden

According to the same *Wall Street Journal* article, the new Data Privacy Framework “opens companies up to more regulatory scrutiny and requires privacy teams to go through extra work to make sure they meet requirements.” What’s more, the payoff might not be worth it, since some business deals will still require additional data privacy assurances beyond the new framework.

Additionally, most organizations that adopt the Data Privacy Framework will [need to consult](https://iapp.org/news/a/eu-us-data-privacy-framework-adopted-what-now/) with both legal counsel and the supervisory data protection authorities in their jurisdiction to ensure that their new practices are compliant. Taken together, these issues may make adopting the Data Privacy Framework a no-go for many companies.

### Privacy experts fear that the framework is insufficient

Some privacy scholars believe that the EU-US Data Privacy Framework does not adequately protect EU personal data. Many concerns have already been raised about the framework, most of which revolve around the powers of the United States government.

For instance, the framework’s Data Protection Review Court operates under the US Attorney General’s authority, casting doubts on its independence. The framework also [does not negate the US CLOUD Act](https://www.csis.org/analysis/cloud-act-and-transatlantic-trust), which allows federal law enforcement to demand sensitive personal data from US-based technology companies. Meanwhile, data subjects are not notified when they are subjected to US intelligence activities, giving them little chance of exercising their privacy rights.

Because of these and other concerns, Max Schrems and his digital privacy nonprofit ​​NOYB have noted that the framework seems to fail in meeting the requirements of Schrems II and the GDPR.

### Organizations are anticipating Schrems III

Given the previous point, it’s probably unsurprising that Max Schrems has announced his intention to file a legal complaint against the new framework. Although the EU anticipates that it can “[credibly defend this framework](https://www.wsj.com/articles/some-companies-shun-long-awaited-trans-atlantic-data-agreement-aa8c7514),” privacy experts suggest that [a Schrems III case is likely](https://www.csis.org/analysis/privacy-heading-schrems-iii) — and that Schrems will again prevail.

What does this mean, long-term? Unfortunately, it seems likely that organizations will remain in a cycle of new data privacy frameworks, followed by litigation that upends those frameworks, for the foreseeable future. In the meantime, though, there are many ways to ensure strong data privacy and security for your business.

## ShardSecure: Supporting data privacy and regulatory compliance

ShardSecure's solution [supports data privacy](https://shardsecure.com/solutions/data-privacy) and meets the European Data Protection Board’s requirements as a supplemental technology to enable cross-border data transfers under the GDPR. Specifically, the ShardSecure platform is a split processing technology that can be easily deployed in a multi-party processing environment, meaning that it allows organizations to store and process data safely under the EDPB’s Use Case 5.

For a more detailed explanation on how the ShardSecure platform mitigates data transfer risks and supports data privacy, take a look at our [GDPR/Schrems II white paper](https://shardsecure.com/resources/white-papers/gdpr-schrems-ii) or peruse [our resources](https://shardsecure.com/resources).

### Sources

[EU Approves Data-Transfer Deal With US, Averting Potential Halt in Flows | WSJ](https://www.wsj.com/articles/eu-approves-data-transfer-deal-with-u-s-averting-potential-halt-in-flows-7a149c9?mod=article_inline)

[Questions & Answers: EU-US Data Privacy Framework | European Commission](https://ec.europa.eu/commission/presscorner/detail/en/qanda_23_3752)

[Data Privacy Framework Program Launches New Website Enabling US Companies to Participate in Cross-Border Data Transfers | US Department of Commerce](https://www.commerce.gov/news/press-releases/2023/07/data-privacy-framework-program-launches-new-website-enabling-us)

[Some Companies Shun Long-Awaited Trans-Atlantic Data Agreement | WSJ](https://www.wsj.com/articles/some-companies-shun-long-awaited-trans-atlantic-data-agreement-aa8c7514)

[EU-US Data Privacy Framework Adopted, What Now? | International Association of Privacy Professionals](https://iapp.org/news/a/eu-us-data-privacy-framework-adopted-what-now/)

[The CLOUD Act and Transatlantic Trust | Center for Strategic and International Studies](https://www.csis.org/analysis/cloud-act-and-transatlantic-trust)

[Privacy — Heading for Schrems III? | Center for Strategic and International Studies](https://www.csis.org/analysis/privacy-heading-schrems-iii)

[Compliance](https://shardsecure.com/blog/tag/compliance)

## Read on

![](https://shardsecure.com/hubfs/Picture2.jpg)

June 15 2026

### [ShardSecure MCP Secure Gateway](https://shardsecure.com/blog/shardsecure-mcp-secure-gateway-identity-aware-data-redaction-and-least-privilege-context-enrichment-for-ai-inference)

[Read more](https://shardsecure.com/blog/shardsecure-mcp-secure-gateway-identity-aware-data-redaction-and-least-privilege-context-enrichment-for-ai-inference)

![](https://shardsecure.com/hubfs/Keyboard%20with%20high%20tech%20user%20map%20icons%20and%20symbols-1.jpeg)

February 18 2026  | [Cloud](https://shardsecure.com/blog/tag/cloud)

### [Unstructured Data Left Exposed: A Cloud Breach That Should Worry Every Enterprise](https://shardsecure.com/blog/unstructured-data-left-exposed-a-cloud-breach-that-should-worry-every-enterprise)

[Read more](https://shardsecure.com/blog/unstructured-data-left-exposed-a-cloud-breach-that-should-worry-every-enterprise)

![](https://shardsecure.com/hubfs/Keyboard%20with%20high%20tech%20user%20map%20icons%20and%20symbols-1.jpeg)

November 12 2025  | [Cloud](https://shardsecure.com/blog/tag/cloud)

### [Can You Really Trust Hyperscalers with Your Data at Rest?](https://shardsecure.com/blog/can-you-really-trust-hyperscalers-with-your-data-at-rest)

[Read more](https://shardsecure.com/blog/can-you-really-trust-hyperscalers-with-your-data-at-rest)

![](https://shardsecure.com/hubfs/AI-Generated%20Media/Images/Acronis%20and%20ShardSecure%20unveil%20a%20groundbreaking%20technology%20partnership%20set%20against%20a%20backdrop%20of%20a%20sleek%20modern%20office%20filled%20with%20digital%20screens%20displaying%20dynamic%20data%20flows%20The%20atmosphere%20buzzes%20with%20excitement%20and%20anticipation%20illuminated%20by%20sof-1.png)

October 16 2025  | [Cloud](https://shardsecure.com/blog/tag/cloud)

### [Acronis + ShardSecure: Stronger data protection for modern threats](https://shardsecure.com/blog/acronis-shardsecure-stronger-data-protection-for-modern-threats)

[Read more](https://shardsecure.com/blog/acronis-shardsecure-stronger-data-protection-for-modern-threats)

![](https://shardsecure.com/hubfs/AI-Generated%20Media/Images/The%20image%20portrays%20a%20hightech%20digital%20landscape%20filled%20with%20abstract%20representations%20of%20data%20security%20concepts%20At%20the%20forefront%20a%20glowing%20vault%20symbolizing%20advanced%20filelevel%20encryption%20stands%20tall%20surrounded%20by%20intricate%20patterns%20of%20fragmented%20data.png)

October 1 2025  | [Data Sensitivity](https://shardsecure.com/blog/tag/data-sensitivity)

### [Revolutionizing Data Security: How Agentless File Level Encryption Makes Stolen Data Useless](https://shardsecure.com/blog/sensitive_data)

[Read more](https://shardsecure.com/blog/sensitive_data)

![unstructured data](https://shardsecure.com/hubfs/Digital%20image%20of%20globe%20with%20conceptual%20icons.%20Globalization%20concept.jpeg)

September 15 2025  | [Cybersecurity News](https://shardsecure.com/blog/tag/cybersecurity-news)

### [Elevating unstructured data security: ShardSecure® and Entrust® Join Forces!](https://shardsecure.com/blog/entrust_partnership)

[Read more](https://shardsecure.com/blog/entrust_partnership)

![](https://shardsecure.com/hubfs/AI-Generated%20Media/Images/scales%20%20ransomware%20attack%20to%20pay%20the%20money%20or%20risk%20the%20attack.jpeg)

July 29 2025  | [Ransomware](https://shardsecure.com/blog/tag/ransomware)

### [CISOs on Strategic Considerations in Ransomware Response](https://shardsecure.com/blog/ransomware-fine)

[Read more](https://shardsecure.com/blog/ransomware-fine)

![](https://shardsecure.com/hubfs/AI-Generated%20Media/Images/Image%20for%20AI%20data%20types-1.jpeg)

July 29 2025  | [Data security](https://shardsecure.com/blog/tag/data-security)

### [The Growth of AI is driving the Imperative of Securing Unstructured Data](https://shardsecure.com/blog/ai-unstructured-data)

[Read more](https://shardsecure.com/blog/ai-unstructured-data)

![](https://shardsecure.com/hubfs/AI-Generated%20Media/Images/The%20image%20depicts%20a%20hightech%20digital%20landscape%20showcasing%20a%20sleek%20modern%20office%20environment%20illuminated%20by%20soft%20blue%20and%20white%20lighting%20In%20the%20foreground%20a%20large%20computer%20screen%20displays%20intricate%20graphs%20and%20charts%20related%20to%20data%20security%20while%20a%20gr.jpeg)

July 22 2025  | [Data security](https://shardsecure.com/blog/tag/data-security)

### [How to make your SharePoint data of zero value in a zero day attack!](https://shardsecure.com/blog/sharepoint_breach)

[Read more](https://shardsecure.com/blog/sharepoint_breach)

[![ShardSecure®](https://shardsecure.com/hubfs/ShardSecure%20brand%20assets/Logo%20(2022)/ShardSecure-Logo__Horizontal--White.svg "ShardSecure®")](https://shardsecure.com/)

101 Avenue of the Americas, 9th Floor, New York, NY 10013, United States of America

[![linkedin](https://shardsecure.com/hubfs/_2023/li.svg) ](https://www.linkedin.com/company/shardsecure) [![tweeter](https://shardsecure.com/hubfs/_2023/tweeter.svg) ](https://www.twitter.com/ShardSecure) [![facebook](https://shardsecure.com/hubfs/_2023/facebook.svg) ](https://www.facebook.com/ShardSecure/) [![facebook](https://shardsecure.com/hubfs/_2023/youtube.svg) ](https://www.youtube.com/@shardsecure877)

© 2026 ShardSecure®. All rights reserved.   
[Privacy Policy](https://shardsecure.com/privacy-policy)

![websights](https://ws.zoominfo.com/pixel/62e7bb6d62a6b2008e071c83) ![](https://px.ads.linkedin.com/collect/?pid=5456580&fmt=gif)

```json
{
  "@context" : "https://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "ShardSecure",
    "url" : "https://shardsecure.com/blog/author/shardsecure"
  },
  "dateModified" : "2023-08-11T09:04:46.889Z",
  "datePublished" : "2023-08-11T09:04:46.000Z",
  "headline" : "The EU-US Data Privacy Framework Was Just Approved. Why Are Some Companies Avoiding It?",
  "image" : [ "https://shardsecure.com/hubfs/Financial%20paper%20charts%20and%20graphs%20on%20the%20table.jpeg" ],
  "mainEntityOfPage" : {
    "@id" : "https://shardsecure.com/blog/avoiding-data-privacy-framework",
    "@type" : "WebPage"
  },
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "url" : "https://shardsecure.com/hubfs/ShardSecure-Logo__Horizontal--Purple-Inverted.svg"
    },
    "name" : "ShardSecure"
  }
}
```