EU-US DPF

The EU-US Data Privacy Framework lets personal data flow from the EU to US organizations that self-certify to it, without standard contractual clauses or other transfer tools. It rests on a European Commission adequacy decision adopted on 10 July 2023 and on US commitments limiting intelligence access to data, with a new redress route through the Data Protection Review Court.

There are matching arrangements for the UK (the UK Extension) and Switzerland (the Swiss-US DPF).

• US organizations subject to the jurisdiction of the Federal Trade Commission or the Department of Transportation that self-certify with the US Department of Commerce and publicly commit to the DPF Principles.
• EU exporters sending personal data to a certified organization, which can rely on the adequacy decision for data within the scope of that organization's certification.
• Human resources data is covered only if the organization certified for it.

EU individuals can access and correct their data held by a certified organization, opt out of disclosure to third parties and of use for materially different purposes, bring complaints free of charge to an independent recourse mechanism, and, as a last resort, invoke binding arbitration. They can also complain about US intelligence access through their data protection authority to the Data Protection Review Court.

La FTC y el Departamento de Transporte hacen cumplir los compromisos de las organizaciones certificadas, incluso frente a declaraciones falsas de participación. El Departamento de Comercio puede excluir a las organizaciones que incumplan de forma persistente.

1. As an exporter, check the DPF List for the recipient's active certification and that it covers the data you send, including HR data.
2. As a US organization, self-certify, publish a compliant privacy policy, choose an independent recourse mechanism, and recertify every year.
3. Put onward transfer contracts in place with your own vendors.
4. Keep a fallback: standard contractual clauses and a transfer impact assessment ready if the framework is invalidated.
5. Track the appeal and the Commission's periodic reviews.