After three months of often-tense meetings, Europe and the U.S. agreed to a pact to enable digital data to move back and forth across the Atlantic. Negotiating beyond the January 31 deadline, European and U.S. officials hammered out details of the “EU-US Privacy Shield,” which will enable Google, Amazon and thousands of other businesses to continue operations. But the agreement isn’t out of the woods: it still faces official approval by the EU’s 28 member states, and EU privacy advocates have vowed to oppose it.

The New York Times reports that the new pact will replace a previous 15-year pact that Europe’s highest court struck down in October. At risk is the all-important data — including social media posts and financial information — that are crucial to the operation of digital companies such as Google, Facebook and Amazon as well as major corporations such as Pfizer and General Electric.

To close the deal, the American negotiators had to agree to a European Commission demand to limit access of the data to American intelligence agencies, with annual written assurances to be reviewed by European officials. “We will hold the U.S. accountable on the commitments that they have made,” said European Union justice commissioner Vera Jourova, who led the EU negotiating team.

But that might not be enough for some European consumer groups that are already preparing legal challenges to the pact. Europe’s own national privacy agencies are scrutinizing the deal, and privacy rights groups “expressed concern that the data-transfer deal does not comply with European law, which views an individual’s right to privacy almost on par with freedom of expression,” urging the U.S. to improve its own privacy laws.

Still, U.S. Commerce secretary Penny Pritzker calls the deal “a major achievement for privacy and for businesses on both sides of the Atlantic.”

“It provides certainty that will help grow the digital economy,” she said. If the pact is approved, it will go into effect by early April.