EU-US Data Privacy Framework Victory: What 46% of Organizations Still Can’t See

Europe’s General Court upheld the lawfulness of the data-sharing agreement between the European Union and the United States on September 3, dismissing a legal challenge from a French MP to annul the EU-US Data Privacy Framework. The court found that the framework ensures “an adequate level” of protection for personal data transfers, providing apparent certainty for businesses relying on the DPF to exchange data between the EU and the US.

Yet while this ruling offers legal clarity, it masks a troubling operational reality. According to Kiteworks’ 2025 Data Security and Compliance Risk: Annual Survey Report, 46% of organizations don’t even know how many third parties have access to their data – the very data now legally flowing across the Atlantic. This fundamental visibility gap creates a cascade of security failures that multiply risk exponentially, regardless of regulatory frameworks.

The correlation revealed in the Kiteworks report is striking. Among organizations that can’t count their third-party relationships, 46% also don’t know how often they’re being breached. Legal permission to transfer data means little when organizations can’t track who has access or detect when that access is compromised.

Court Decision in Context

The General Court’s decision represents the latest chapter in Europe’s ongoing effort to balance data protection with economic necessity. After the collapse of Safe Harbor and Privacy Shield frameworks, the Data Privacy Framework emerged as the mechanism for lawful EU-US data transfers. The court’s validation provides much-needed stability for the thousands of businesses that depend on transatlantic data flows.

However, the ruling’s emphasis on “adequate level” of protection highlights a critical distinction between legal compliance and operational security. The framework establishes the legal basis for transfers, but organizations must still implement the technical and procedural safeguards that constitute actual protection. This is where the visibility crisis identified by Kiteworks becomes crucial.

Consider what “adequate protection” means in practice. It requires knowing exactly what data crosses borders, who accesses it, for what purpose, and with what safeguards. Yet if 46% of organizations don’t know their third-party count, how can they ensure adequate protection for data flowing through those unknown channels?

Third-Party Visibility Crisis

The Kiteworks report reveals that 46% of organizations admit they don’t know how many third parties exchange private data with their systems. In the context of EU-US data transfers, this blindness becomes particularly dangerous. Each third party potentially moves data across jurisdictions, creating compliance obligations and security risks that compound with every unknown connection.

Third parties in transatlantic operations include cloud service providers (many US-based), marketing platforms processing EU customer data, HR systems managing employee information across regions, and supply chain partners with cross-border operations. Under the Data Privacy Framework, each relationship requires appropriate safeguards, but you can’t protect what you can’t see.

The survey identifies a particularly dangerous threshold: organizations with 1,001 to 5,000 third-party relationships post the highest risk score of 5.19 on Kiteworks’ 10-point scale. For companies operating across the Atlantic, this danger zone often emerges naturally. A European company using US cloud services quickly accumulates connections through integrations, APIs, and service dependencies.

Geographic complexity multiplies the challenge. A seemingly simple setup – European headquarters using a US-based CRM – can spawn dozens of data flows through integrated marketing tools, analytics platforms, and support systems. Each integration might independently transfer EU personal data to US servers, creating a web of compliance obligations that becomes impossible to track manually.

Detection Delays in a Transatlantic Context

Kiteworks research shows that among companies with more than 1,000 third parties, 53-54% take over 30 days to detect breaches. In the context of EU-US data transfers, this delay creates multiple compliance failures beyond the security impact.

GDPR‘s 72-hour breach notification requirement applies regardless of where data is processed. If a US-based third party suffers a breach affecting EU data, the clock starts ticking when the incident becomes known. But with detection delays averaging 31-90 days, organizations face automatic non-compliance before they even discover the problem.

The Data Privacy Framework assumes organizations can demonstrate their security measures and respond promptly to incidents. Yet the Kiteworks data reveals this assumption doesn’t match operational reality. When breaches take months to detect, the framework’s protections become theoretical rather than practical.

Financial implications escalate in cross-border contexts. Organizations detecting breaches within 24 hours typically keep costs under €1 million, but when detection stretches beyond 30 days, 47% face litigation costs exceeding €3 million. Add the complexity of multiple jurisdictions – EU penalties, US litigation, contractual damages – and costs multiply further.

Industry Readiness and Regulatory Convergence

The Kiteworks report shows dramatic variation in regulatory preparedness across industries, with implications for Data Privacy Framework compliance. Financial Services leads with 47% ready for the EU Data Act, while Education lags at 14%. This variation affects how different sectors handle transatlantic data transfers.

Financial services organizations, accustomed to regulatory scrutiny, often have robust frameworks for managing cross-border transfers. Technology companies at 44% readiness leverage their technical capabilities but may underestimate legal complexities. Meanwhile, sectors like Healthcare, Manufacturing, and Education struggle with basic compliance, let alone sophisticated international data governance.

The regulatory pile-up effect compounds these challenges. Organizations must navigate GDPR, the EU Data Act, NIS 2, DORA, and various US state privacy laws simultaneously. With 90% citing GDPR as their most impactful regulation, many haven’t adapted to the broader compliance landscape that governs modern data transfers.

Between 25-32% of organizations spend 1,001-1,500 hours annually on compliance activities – essentially a full-time position just for regulatory reporting. Yet 20-26% don’t even track compliance time, suggesting they lack the basic project management discipline needed for complex international operations.

Building Visibility for Adequate Protection

The path from the General Court’s “adequate protection” standard to operational reality requires comprehensive visibility. Organizations achieving the best outcomes maintain real-time inventories of all third-party relationships, with particular attention to those involving cross-border data transfers.

For EU-US operations, this means mapping not just direct transfers but the entire data lifecycle. When EU customer data enters a US-based CRM, where does it flow next? Which integrated services access it? Do those services maintain Data Privacy Framework compliance? Without this visibility, adequate protection remains an aspiration rather than achievement.

Automation becomes essential at scale. Manual tracking fails around 100 third-party relationships, yet many organizations operating internationally have thousands. Automated discovery tools can identify unauthorized transfers, flag policy violations, and generate the audit trails that demonstrate compliance with both GDPR and Data Privacy Framework requirements.

The technology stack must integrate across jurisdictions. Identity management systems need to track access regardless of geographic location. Contract management must capture Data Privacy Framework adherence alongside other vendor requirements. Security monitoring must correlate threats across regions while respecting data localization requirements.

ROI of Governance in a Global Context

The Kiteworks report demonstrates that organizations with mature privacy programs achieve 27% reduced security losses. For companies managing EU-US data transfers, this ROI becomes even more compelling given the higher stakes of international operations.

Customer loyalty improvements of 21% reflect growing awareness of data protection, particularly in privacy-conscious European markets. Organizations that can demonstrate robust governance for international transfers win business from competitors who can’t provide similar assurances.

The 21% operational efficiency gain proves especially valuable for international operations. Instead of managing separate compliance frameworks for each jurisdiction, mature organizations build unified approaches that satisfy multiple requirements simultaneously. This efficiency enables faster market entry and smoother international expansion.

Private Data Network Approach to Data Sovereignty

While the Data Privacy Framework provides the legal mechanism for transfers, organizations need technical infrastructure that ensures actual sovereignty over their data. This is where the concept of a Private Data Network becomes critical. Unlike traditional security approaches that focus on perimeter defense, a Private Data Network provides unified governance across all data flows – whether they’re moving between EU and US operations, through third-party systems, or via AI-powered services.

A Private Data Network creates a controlled environment where every data interaction is tracked, governed, and secured according to policy. For EU-US operations, this means maintaining sovereignty even when data physically resides in US data centers. Organizations can enforce EU privacy requirements on data stored in US systems, demonstrate compliance through comprehensive audit trails, and maintain control over access regardless of geographic location.

The approach proves particularly valuable given the infrastructure reality revealed in recent studies: 72% of European cloud infrastructure operates under US control. Rather than fighting this reality or attempting to repatriate all data, organizations can use Private Data Network principles to maintain governance authority while leveraging global infrastructure efficiently.

Key capabilities for transatlantic operations include:

• Unified policy enforcement across all jurisdictions
• Real-time visibility into data location and access
• Automated compliance controls that adapt to local requirements
• Encryption key management that maintains organizational control
• Audit trails that satisfy both GDPR and US regulatory requirements

AI Governance in the Age of Cross-Border Data Flows

The Kiteworks report reveals a critical gap in AI governance that becomes especially dangerous in international contexts. While 36% of organizations with unknown AI usage implement zero privacy technologies, the implications multiply when AI systems process data across borders without oversight.

Consider how AI amplifies data sovereignty challenges. A marketing AI trained on EU customer data might run on US infrastructure, making predictions that flow back to European operations. Without proper governance, organizations can’t answer basic questions: Which AI systems access EU personal data? Where is that data processed? How are AI decisions affecting EU citizens documented and explained?

The EU’s upcoming AI Act adds another layer of complexity to the Data Privacy Framework. Organizations must not only ensure lawful data transfers but also demonstrate AI governance that meets European standards regardless of where processing occurs. This includes:

• Documenting AI training data sources and cross-border flows
• Implementing bias detection for AI systems affecting EU citizens
• Maintaining explainability records for automated decisions
• Ensuring human oversight capabilities across jurisdictions

Organizations measuring and governing their AI usage show dramatically better outcomes. According to Kiteworks, 93-96% of companies that track AI data flows implement at least one privacy-enhancing technology, compared to the 36% implementing nothing when operating blind. This gap represents both risk and opportunity – organizations with mature AI governance can leverage artificial intelligence advantages while maintaining compliance, while those without governance face escalating regulatory and security exposure.

Building Resilience Through Integrated Governance

The convergence of challenges – third-party blindness, AI proliferation, and cross-border complexity – requires integrated governance approaches. Organizations can no longer treat each challenge in isolation. The same third-party processing EU data might use AI systems hosted in the US, creating overlapping obligations under GDPR, the Data Privacy Framework, and emerging AI regulations.

Successful organizations build governance platforms that provide:

• Unified visibility across all data types and processing methods
• Automated policy enforcement that adapts to context
• Integrated compliance reporting across multiple frameworks
• Scalable architecture that grows with regulatory complexity

This integrated approach delivers measurable benefits beyond compliance. Organizations report faster vendor onboarding when governance is automated. They achieve quicker AI deployment when privacy controls are built in. They expand internationally with confidence, knowing their governance scales across jurisdictions.

Looking Forward

The General Court’s decision provides legal certainty for EU-US data transfers, but operational challenges remain. With 46% of organizations unable to count their third parties and detection delays averaging over 30 days, many companies can’t demonstrate the “adequate protection” the framework requires.

Success requires moving beyond checkbox compliance to comprehensive visibility and governance. Organizations must know every third party, map every data flow, and detect every incident promptly. The tools and techniques exist – the Kiteworks report shows that mature organizations achieve dramatically better outcomes across every metric.

The Data Privacy Framework creates opportunity for organizations with strong governance while exposing those operating blind to increased risk. As regulatory complexity accelerates and threats multiply, the gap between leaders and laggards will only widen. The court gave permission for data to flow, but only organizations with visibility and control can ensure it flows safely.

Additional Resources

• Blog Post Zero Trust Architecture: Never Trust, Always Verify
• Video How Kiteworks Helps Advance the NSA’s Zero Trust at the Data Layer Model
• Blog Post What It Means to Extend Zero Trust to the Content Layer
• Blog Post Building Trust in Generative AI with a Zero Trust Approach
• Video Kiteworks + Forcepoint: Demonstrating Compliance and Zero Trust at the Content Layer