Many trials send EU participant data to US sponsors, CROs, labs and cloud providers. The Data Privacy Framework is one lawful route for that, if the recipient is certified. This guide explains when it helps, when it does not and what to check. It is a plain-language explainer, not legal advice.
Free sandbox · No credit card · 21 CFR Part 11 aligned
Is personal data leaving the EEA?
Including remote access from a US team to EU-hosted data
Is the recipient on the DPF list?
Active certification, covering the type of data
If yes: rely on the adequacy decision
Check the scope of their certification
If no: another Article 46 tool
Standard contractual clauses or binding corporate rules
Document the decision
In the DPIA and the data management plan
Re-check on a schedule
Frameworks and certifications change
The framework in six points
Why it matters
GDPR Chapter V restricts transfers of personal data from the EU or EEA to countries outside it unless one of a short list of conditions is met. A multi-country trial triggers that constantly, because the data trail has many ends: a European site sends coded data to a US sponsor, a US central laboratory receives samples and results, a US-based CRO monitors, a US vendor supports the database, and a safety team in another region reads reports at night.
Each of those is a separate question: who is the exporter, who is the importer, what data (coded or not, special category health data in almost every case), and under which tool. For the wider regime comparison see HIPAA versus GDPR for clinical trial data, and for the product-selection angle GDPR compliant clinical trial software and the best EDC for European trials.
Because trial data is health data, which GDPR treats as a special category, and because trials are long, any uncertainty in the transfer mechanism is a multi-year risk. That is why the DPF litigation matters to a clinical team more than a generic marketing database.
The options
A simplified overview. Each tool has conditions, so treat this as orientation and confirm with your data protection officer or counsel.
| Mechanism | What it is | Fits when | Watch for |
|---|---|---|---|
| Adequacy decision, including the DPF (Art 45) | Commission decision that a framework or country offers adequate protection; for the DPF, the recipient must be certified | The US recipient is on the list with an active certification covering your data | Certification scope and status, and the outcome of the legal challenge |
| Standard contractual clauses (Art 46) | Model contract terms adopted by the Commission, signed between exporter and importer | The recipient is not certified, or you want a fallback | A transfer impact assessment is normally expected, and the clauses must be completed accurately |
| Binding corporate rules (Art 46) | Group-wide rules approved by regulators | Within a large multinational group | Slow to obtain, rarely relevant to a small sponsor |
| Derogations (Art 49) | Narrow exceptions such as explicit consent for a specific transfer | Occasional, non-repetitive cases | Regulators read them narrowly; not a basis for routine trial data flows |
| Keep the data in the EU | Host in the EU and restrict who can access it from outside | You can serve all users from within the EEA | Remote access from outside the EEA can still be a transfer |
EDPB guidance has said that the safeguards the US introduced for the DPF are relevant to assessments under other tools too. Check the current EDPB position when you document your decision.
Capture offers hosting in the EU (Frankfurt) and the USA (N. Virginia). Set up a demo study in the free sandbox and map who needs access to what.
Who can use it
The DPF does not bless the United States as a whole. It lets a transfer rely on the adequacy decision only if the specific US recipient has self-certified, is listed as active and the certification covers the kind of data you send. The list is public and maintained by the US Department of Commerce on the DPF website.
Eligibility is limited to organisations under the jurisdiction of the FTC or the Department of Transportation. Summaries of the EDPB's FAQ note that some organisations outside those regulators, including some non-profits, cannot self-certify. In research that can matter: a US academic medical centre or non-profit research institute may not be able to rely on the DPF even if a commercial CRO next to it can. We could not confirm the position for universities, so ask each recipient rather than assuming.
A certification also has a data scope, such as human resources data versus other data. A certified recipient whose certification covers only HR data is not a route for participant data. Ask for the DPF list entry and read it.
The framework principles include supplemental material on pharmaceutical and medical products. Our reading of secondary summaries, including summaries of the earlier Privacy Shield text, is that it addresses clinical trials and product safety monitoring, that EU law governs collection and pre-transfer processing, and that a transfer of key-coded data which remains EU personal data under EU law is covered by the principles. We did not read the current official text, so have counsel check it before you rely on a specific rule.
Legal status
The DPF replaced the Privacy Shield, which the Court of Justice invalidated in the 2020 Schrems II judgment. That history is why many regulators and sponsors treat any US transfer mechanism cautiously. As of our research on 16 October 2026, we found the following. The Commission reported on its first periodic review on 9 October 2024 (COM(2024) 451), concluding that US authorities had put the necessary structures and procedures in place and that it was too early to judge how the framework functions in practice.
In the General Court case Latombe v Commission (T-553/23), the court dismissed the annulment action on 3 September 2025, holding, on the reports we saw, that the review mechanism for US intelligence activity met the required standard of independence. An appeal to the Court of Justice (C-703/25 P) was lodged on 31 October 2025, and we found no hearing date, Advocate General opinion or judgment. If that changes, the DPF could be limited or annulled, as the Privacy Shield was.
For a sponsor, the practical answer is not to guess the outcome. It is to make the transfer arrangement robust to either result: keep a fallback tool (such as standard contractual clauses) ready for your key US recipients, document the assessment, and avoid designs where a single framework is the only thing holding up a multi-year dataset.
Trial data flows
Draw the flows before you pick tools. The panel is an invented example of the questions to answer for each recipient, with the tool as the last column rather than the first.
| Data | DPF certified? | Fallback tool | |
|---|---|---|---|
| Sponsor (US), coded clinical data | Check list | Standard contractual clauses | |
| Central lab (US), results by participant code | Check list | Standard contractual clauses | |
| US CRO, remote monitoring | Check list | Standard contractual clauses | |
| US academic site (non-profit) | Often not eligible | Standard contractual clauses | |
| EU-hosted EDC, EU staff only | Not applicable | None needed |
What to do
Include sponsors, CROs, labs, imaging cores, safety vendors, the EDC vendor and its support staff, and cloud providers.
Identified, coded or aggregated? Identifiable health data is the highest-risk category; coded data is still personal data for whoever can re-identify.
Check the DPF list for an active certification that covers your data type. If it does not, use standard contractual clauses and run a transfer impact assessment.
Share coded data, restrict names to the site and limit exports by site and date range. Capture's role-based access, PII segregation and row-level security help here (see data pseudonymization in EDC).
Put the map in the DPIA and the data management plan. Our DPIA template and data management plan template have room for it.
Set a review date for certifications and the framework, and an event trigger if a court decision appears.
Software
Ask three questions of any EDC vendor, including Capture. Where is the data stored, and can you choose? Who can access it from outside that region, and under which transfer tool? Which of its own sub-processors are outside the EEA? Get the answers in the contract and the data processing agreement, not on a sales slide. Our EDC vendor audit checklist has the broader list.
Capture hosts in the EU (Frankfurt) and in the USA (N. Virginia), with AES-256 encryption at rest and TLS in transit. It applies role-based access, PII segregation (site coordinators see names, researchers see coded IDs) and row-level security at the database layer. We do not state on this page that Capture or any sub-processor is certified to the DPF, because we have not published that, so ask us directly and read the DPF list yourself. For the controls that reduce what leaves a site, see role-based access control for clinical trials.
The same applies to any study with EU sites: also read the EU Clinical Trials Regulation guide for the rules that sit alongside GDPR.
Checklist
Each exporter, importer, data type and purpose is on one page.
Screenshot or export of the list entry with date, scope and status.
Standard contractual clauses signed or ready to sign for key recipients.
Reviewed by your DPO and refreshed when the legal position changes.
Who outside the EEA can open EU-hosted data, and how that is controlled.
Consent and information sheets describe transfers outside the EEA in plain language.
A named owner and a date, plus a trigger for any court decision.
It is a mechanism, based on a European Commission adequacy decision of July 2023, that allows personal data to flow from the EU to US organisations that have self-certified to the framework without an additional transfer tool for that transfer.
Only for transfers to a US recipient with an active certification that covers the data in question. Many trial data flows involve recipients that are not certified, so a fallback such as standard contractual clauses is common.
As far as we found on 16 October 2026, yes. The General Court dismissed a challenge on 3 September 2025, and an appeal to the Court of Justice (C-703/25 P) was pending. Check for any new judgment.
It reduces them, but regulators generally treat remote access from outside the EEA as a transfer. Map who can open the data, not only where it is stored.
For anyone who can re-identify participants, such as the site or sponsor holding the key, yes. Coded data does not take a transfer outside GDPR by itself.
Self-certification requires being under FTC or Department of Transportation jurisdiction, and some non-profits are outside it. We could not confirm the position for universities, so ask each recipient.
This page makes no such claim. Capture offers EU (Frankfurt) and US (N. Virginia) hosting. Ask us about our contractual transfer arrangements and check the public DPF list for any certification.
No. It is a general explainer based on web research on 16 October 2026. Speak to your data protection officer or counsel for decisions on your own trial.
Keep exploring
HIPAA vs GDPR for clinical trial data
How the two regimes compare.
Data pseudonymization in EDC
How Capture separates identity from clinical data.
Pseudonymization vs anonymization
Which data is outside GDPR.
GDPR compliant clinical trial software
What to look for in an EDC.
GDPR DPIA template for clinical trials
Document the assessment.
Best EDC for European trials
EU hosting and selection criteria.
Free sandbox with every feature. No credit card, and you pay only when you go live with real participants.