January 2026 brought three developments worth knowing: the EU-Brazil adequacy decision was finalised, new SCCs for a specific transfer scenario are still delayed, and the EDPB mapped out its guidance agenda for the year ahead.

The EU-US Data Privacy Framework is still standing, but its future is not guaranteed. Here is what has happened, why the uncertainty around transatlantic data transfers is not over, and what practical steps you can take to protect your business.