EDPB Opinion 08/2026 — onward transfers from DPF importers now need independent basis

What the law is now

EU personal data can flow to the United States under the Data Privacy Framework where the US importer is certified. Outside the DPF, a transfer needs standard contractual clauses and a transfer impact assessment. Onward transfers — where the US importer sends that data to a third party — were previously assumed to ride the same DPF cover as the primary transfer.

What just shifted

Shift EU Primary source

What this adds: The EDPB Opinion clarifies that each onward transfer from a DPF-certified importer requires its own independent legal basis, either DPF certification by the onward recipient or SCCs with a fresh transfer impact assessment covering the onward recipient's country.

What this puts in question: Whether data processing agreements that assumed onward transfer cover flowed automatically from the primary DPF basis still satisfy GDPR Article 46.

What clients should weigh

·Do we move EU personal data to any US sub-processors that then forward it further — to analytics vendors, AI processors, or CDN infrastructure — and on what legal basis does each of those secondary flows rest?

·Is each sub-processor that receives onward data independently DPF-certified, and do we have that certification on file, or did we assume coverage flowed from the primary transfer?

·Do our data processing agreements name the onward transfer basis expressly, or are they silent on secondary flows?

·This Opinion sharpens the onward-transfer obligation. It does not change the legal basis for the primary EU-to-US transfer, so do not read it as calling the original DPF or SCC basis into question.

EDPB Opinion 08/2026 ›

Watch for

· UK adequacy bridge for DPF, decision expected Q3 2026

· EDPB guidance on SCCs for AI processor relationships

Ready to use

These are drafts. Edit before sending to a client.

Client alert

Draft — edit before sending to a client.

This corpus reflects one attorney's personal review. It is not a comprehensive survey. Verify scope and currency before relying on it for any matter.