EU–US Data Privacy Framework & International Data Transfers


PharMarketing helps pharmaceutical, biotech, CRO, medical device and digital health organisations establish compliant international data-transfer arrangements. We support organisations transferring personal datan including patient, clinical trial participant, healthcare-professional and employee data from the European Economic Area (EEA), the United Kingdom and Switzerland to the United States and other third countries.


The EU–US Privacy Shield is no longer the appropriate mechanism to promote. The current framework is the EU–US Data Privacy Framework (DPF), for which the European Commission adopted an adequacy decision on 10 July 2023.


EU–US Data Privacy Framework Support

The EU–US Data Privacy Framework enables eligible, participating US organisations to receive personal data from the EEA under the European Commission’s adequacy decision. It is available only to US organisations that self-certify to the US Department of Commerce and commit publicly to comply with the relevant DPF Principles.


PharMarketing helps US life sciences organisations evaluate whether DPF participation is appropriate for their data-transfer model and privacy programme.


Our DPF support can include:

  • Assessment of whether EU–US DPF participation fits your organisation’s transfer activities
  • Review of data flows from the EEA, UK and Switzerland to the United States
  • Gap analysis against relevant DPF commitments and GDPR obligations
  • Support for privacy notices, policies and internal procedures
  • Assistance with DPF self-certification preparation
  • Support for annual recertification and continuing compliance
  • Coordination with internal privacy, legal, IT security, clinical and vendor-management teams


DPF participation requires initial self-certification and annual recertification with the US Department of Commerce to retain participation in the programme.


Standard Contractual Clauses and TIAs

The DPF is not the only lawful transfer mechanism, and it will not apply to every transfer or recipient. When a US or other non-EEA recipient is not covered by an adequacy decision or an applicable transfer framework, organisations may need other safeguards.


PharMarketing supports international data-transfer compliance using tools such as:

  • European Commission Standard Contractual Clauses (SCCs)
  • UK international data-transfer mechanisms
  • Transfer Impact Assessments (TIAs)
  • Data-transfer mapping and data-flow analysis
  • Assessment of supplementary technical, contractual and organisational measures
  • Review of vendor and data-processing agreements
  • Transfer governance for clinical trials, research platforms and global vendor ecosystems


The European Commission’s SCCs require parties to assess whether laws and practices in the destination country could prevent the data importer from complying with the clauses. This assessment is commonly documented in a Transfer Impact Assessment and should consider the circumstances of the transfer, the recipient, the sector and relevant safeguards.


Data Transfers in Clinical Research

International data transfers are particularly complex in life sciences because clinical programmes frequently involve multiple parties, systems and jurisdictions.


Common scenarios include:

  • EU clinical trial data hosted or accessed in the United States
  • US-based sponsors working with EU CROs, sites and laboratories
  • Global safety, pharmacovigilance and medical-information platforms
  • Cloud-based eClinical, EDC, CTMS and patient-engagement systems
  • Cross-border transfers of health, genetic or other special-category data
  • International vendors and sub-processors supporting clinical operations


PharMarketing helps map these transfer ecosystems and implement proportionate safeguards that support GDPR compliance while enabling efficient clinical research and global operations.


Our team combines GDPR, data-protection, IT security and life sciences knowledge. We understand the operational realities of multi-country studies, outsourced clinical development, global platforms and sensitive health-data processing.


We help organisations move beyond generic privacy documentation by translating international transfer requirements into practical actions for sponsors, CROs, technology vendors and research partners.