EU-US Data Privacy Framework Victory: What Almost Half of Organisations Still Can’t See

By Rick Goud, Co-founder & Chief Innovation Officer, Zivver (a Kiteworks company)

Earlier this month, Europe’s General Court upheld the lawfulness of the data-sharing agreement between the European Union and the United States, dismissing a legal challenge from a French MP to annul the EU-U.S. Data Privacy Framework. The court found that the framework ensures “an adequate level” of protection for personal data transfers, providing apparent certainty for businesses relying on the DPF to exchange data between the EU and the U.S.

Yet while this ruling offers legal clarity, it masks a troubling operational reality. According to Kiteworks’ 2025 Data Security and Compliance Risk: Annual Survey Report, 46% of organisations don’t even know how many third parties have access to their data – the very data now legally flowing across the Atlantic. This fundamental visibility gap creates a cascade of security failures that multiply risk exponentially, regardless of regulatory frameworks.

The correlation revealed in the report is striking. Among organisations that can’t count their third-party relationships, 46% also don’t know how often they’re being breached. Legal permission to transfer data means little when organisations can’t track who has access or detect when that access is compromised.

Finding the right balance

The General Court’s decision represents the latest chapter in Europe’s ongoing effort to balance data protection with economic necessity. After the collapse of Safe Harbor and Privacy Shield frameworks, the Data Privacy Framework emerged as the mechanism for lawful EU-U.S. data transfers. 

However, the ruling’s emphasis on “adequate level” of protection highlights a critical distinction between legal compliance and operational security. The framework establishes the legal basis for transfers, but organisations must still implement the technical and procedural safeguards that constitute actual protection. 

Cross-border connections

In the context of EU-U.S. data transfers, the fact that 46% of organisations don’t know how many third parties exchange private data becomes particularly dangerous. Moving data across jurisdictions creates compliance obligations and security risks that compound with every unknown connection.

A seemingly simple setup – European headquarters using a U.S.-based CRM – can spawn dozens of data flows through integrated marketing tools, analytics platforms, and support systems. Each integration might independently transfer EU personal data to U.S. servers, creating a web of compliance obligations that becomes impossible to track manually.

Detection delays 

Of course, it becomes more difficult the bigger the organisation is. For companies with more than 1,000 third parties, 53% take over 30 days to detect breaches. In the context of EU-U.S. data transfers, this delay creates multiple compliance failures beyond the security impact. This becomes a big problem seeing that the GDPR’s has a 72-hour breach notification requirement. 

The Data Privacy Framework assumes organisations can demonstrate their security measures and respond promptly to incidents. Yet this assumption doesn’t match operational reality. When breaches take months to detect, the framework’s protections become theoretical rather than practical.

Building visibility

The path from the General Court’s “adequate protection” standard to operational reality requires comprehensive visibility. For EU-U.S. operations, this means mapping not just direct transfers but the entire data life cycle. When EU customer data enters a U.S.-based CRM, where does it flow next? Which integrated services access it? Do those services maintain Data Privacy Framework compliance? Without this visibility, adequate protection remains an aspiration rather than achievement.

Automation becomes essential at scale. Manual tracking fails around 100 third-party relationships. Yet, some European businesses can have thousands. Automated discovery tools can identify unauthorised transfers, flag policy violations, and generate the audit trails that demonstrate compliance with both GDPR and Data Privacy Framework requirements.

Benefits of a Private Data Network approach

While the Data Privacy Framework provides the legal mechanism for transfers, organisations need technical infrastructure that ensures actual sovereignty over their data. This is where the concept of a Private Data Network becomes critical. Unlike traditional security approaches that focus on perimeter defence, a Private Data Network provides unified governance across all data flows – whether they’re moving between EU and U.S. operations, through third-party systems, or via AI-powered services.

A Private Data Network creates a controlled environment where every data interaction is tracked, governed, and secured according to policy. For EU-U.S. operations, this means maintaining sovereignty even when data physically resides in U.S. data centres. Organisations can enforce EU privacy requirements on data stored in U.S. systems, demonstrate compliance through comprehensive audit trails, and maintain control over access regardless of geographic location.

How AI amplifies the challenge

Unfortunately, the prevalence of AI today is making the issue worse. There is a critical gap in AI governance that becomes especially dangerous in international contexts. Consider how AI amplifies data sovereignty challenges. A marketing AI trained on EU customer data might run on U.S. infrastructure, making predictions that flow back to European operations. Without proper governance, organisations can’t answer basic questions: Which AI systems access EU personal data? Where is that data processed? How are AI decisions affecting EU citizens documented and explained?

The EU’s upcoming AI Act adds another layer of complexity to the Data Privacy Framework. Organisations must not only ensure lawful data transfers but also demonstrate AI governance that meets European standards regardless of where processing occurs. 

Benefits of an integrated approach

The convergence of challenges – third-party blindness, AI proliferation, and cross-border complexity – requires integrated governance approaches. European businesses can no longer treat each challenge in isolation. The same third-party processing EU data might use AI systems hosted in the U.S., creating overlapping obligations under GDPR, the Data Privacy Framework, and emerging AI regulations.

An integrated approach delivers measurable benefits beyond compliance. Organisations report faster vendor onboarding when governance is automated. They achieve quicker AI deployment when privacy controls are built in. Plus, they can expand internationally with confidence, knowing their governance scales across jurisdictions.

Moving beyond checkbox compliance

Success requires European businesses to move beyond checkbox compliance to one of a comprehensive visibility and governance. Organisations must know every third party, map every data flow, and detect every incident promptly. 

The Data Privacy Framework creates opportunity for organisations with strong governance while exposing those operating blind to increased risk. As regulatory complexity accelerates and threats multiply, the gap between leaders and laggards will only widen. The court gave permission for data to flow, but only European businesses with visibility and control can ensure it flows safely.

The post EU-US Data Privacy Framework Victory: What Almost Half of Organisations Still Can’t See appeared first on European Business & Finance Magazine.