EU-US Data Privacy Framework (DPF)

A framework enabling regulated data transfers between the European Union and United States. The framework requires US companies to self-certify adherence to specific privacy principles, including notice, choice, accountability for onward transfer, security, data integrity, purpose limitation, access, and recourse mechanisms. Note: This replaced the previous Privacy Shield framework invalidated by the Schrems II decision.

JurisdictionEuropean Union
CategoryPrivacy & Data Protection
StatusActive
Latest development

Analysis

Key Requirements

  • Self-Certification: U.S. companies must annually self-certify to the U.S. Department of Commerce that they comply with the EU-U.S. Data Privacy Framework (DPF) Principles. Certification must specify the types of personal data covered (e.g., HR data, commercial data) and be publicly available on the company’s website. DPF Program Overview Official DPF Principles
  • Notice: Organizations must inform individuals about their data collection practices, the purposes for which data is processed, types of third parties to whom data is disclosed, and how individuals can exercise their rights. DPF Principles - Notice
  • Choice: Individuals must be given the opportunity to opt out of (or, for sensitive data, opt in to) the disclosure of their personal data to third parties or its use for purposes materially different from those for which it was collected. DPF Principles - Choice
  • Accountability for Onward Transfer: Companies must ensure that any third party receiving personal data also provides the same level of protection as required by the DPF Principles. This includes contractual obligations and monitoring compliance. DPF Principles - Onward Transfer
  • Security: Organizations must take reasonable and appropriate measures to protect personal data from loss, misuse, unauthorized access, disclosure, alteration, and destruction. DPF Principles - Security
  • Data Integrity and Purpose Limitation: Data must be reliable, accurate, complete, and relevant for the purposes for which it is used. Companies must not process personal data in a way incompatible with the purposes for which it was collected. DPF Principles - Data Integrity
  • Access: Individuals must have the right to access their personal data and correct, amend, or delete it where it is inaccurate or processed in violation of the Principles. DPF Principles - Access
  • Recourse, Enforcement, and Liability: Organizations must provide accessible recourse mechanisms for individuals to resolve complaints and disputes, including independent dispute resolution, and must be subject to enforcement by relevant authorities (e.g., FTC). DPF Principles - Recourse FTC DPF Guidance

Compliance Challenges

  • Demonstrating Ongoing Adherence: Maintaining annual self-certification and ensuring all privacy practices remain aligned with the DPF Principles can be resource-intensive, especially for organizations with complex data flows. DPF Program Overview
  • Onward Transfer Compliance: Ensuring that all third-party processors and partners provide equivalent protection and have appropriate contracts in place is a frequent challenge. EDPB DPF FAQ
  • Handling Data Subject Requests: Responding to access, correction, and deletion requests from EU individuals within required timeframes can be operationally demanding. FTC DPF Guidance
  • Real Example: After the invalidation of the Privacy Shield, many companies faced uncertainty and had to rapidly adapt their compliance programs to the new DPF requirements, as detailed in industry analyses. IAPP Analysis: Transition to DPF

Implementation Best Practices

  • Map Data Flows: Identify all personal data transferred from the EU to the U.S., including HR and commercial data, and document processing activities. DPF Implementation Guide
  • Update Privacy Policies: Ensure privacy notices are updated to reflect DPF participation, data processing purposes, and individual rights. DPF Principles - Notice
  • Establish Recourse Mechanisms: Set up independent dispute resolution procedures and communicate these clearly to data subjects. FTC DPF Guidance

Recent Updates

  • Replacement of Privacy Shield: The DPF replaced the Privacy Shield framework, which was invalidated by the Court of Justice of the European Union (CJEU) in the Schrems II decision. EDPB DPF FAQ
  • Ongoing Monitoring: The DPF is subject to annual joint reviews by the European Commission and U.S. authorities to ensure continued adequacy. DPF Program Overview

Related Regulations

| Regulation/Standard | Description | Interaction with DPF | Official Documentation | |---------------------|-------------|----------------------|-----------------------| | GDPR | EU General Data Protection Regulation; sets the baseline for data protection in the EU | DPF provides a lawful transfer mechanism under GDPR Article 45 | GDPR Text | | UK Extension to DPF | Allows data transfers from the UK to the U.S. under similar principles | UK organizations can rely on the DPF for transfers to certified U.S. companies | DPF UK Extension | | Swiss-U.S. DPF | Similar framework for data transfers from Switzerland to the U.S. | Operates alongside the EU-U.S. DPF | Swiss-U.S. DPF |

Industry Impact

  • Technology Sector: U.S. tech companies (e.g., cloud providers, SaaS vendors) benefit from a clear legal basis for transatlantic data transfers, reducing legal uncertainty and business disruption. IAPP Industry Impact Analysis
  • HR and Multinational Firms: Companies transferring HR data for global workforce management can now do so with fewer contractual burdens. EDPB DPF FAQ
  • Consumer Trust: The DPF’s recourse and enforcement mechanisms aim to enhance consumer trust in cross-border data flows. FTC DPF Guidance

Sources

Recent developments

  • — European General Court confirmed the validity of the EU-U.S. DPF adequacy decision, strengthening legal certainty for transatlantic data flows as stated by ITIC in response to the ruling. (source)
  • — Philippe Latombe appealed the General Court's September 2025 decision upholding the DPF to the European Court of Justice, potentially introducing uncertainty for companies relying on it for EU-U.S. data transfers. (source)

Read the full guide to EU-US Data Privacy Framework (DPF)

Related regulations

Put it into practice

Browse all regulations · Compliance deadlines · Latest updates