What Companies Need To Know About The New EU-US Data Privacy Framework For Cross-Border Data Transfers

On July 10, 2023, the European Commission adopted an adequacy decision for the new EU-US Data Privacy Framework ("DPF"), the revamped transatlantic framework designed to support transfers of personal data from the EU to companies in the US that self-certify compliance with the DPF's privacy requirements.

Here is what your organization needs to know:

How Can I Self-Certify To The DPF?

Organizations that wish to self-certify must submit an application beginning July 17, 2023, on a new website that will be set up by the Department of Commerce (DoC). The application will require information such as the name of the organization and a description of the organization's purposes for processing personal data, as well as the appointment of an independent recourse mechanism to investigate unresolved complaints related to the DPF Principles. Organizations must obtain the DoC's approval to be added to the list of DPF participants. Organizations must also update their