Blog

EU-US DPF in review: Your next steps to self-certify and maintain compliance

The European Commission’s first review into the EU-US DPF adequacy decision has highlighted some key areas of focus for organisations seeking to self-certify or maintain compliance with the framework

Robb Taylor-Hiscock
Privacy Content Lead, CIPP/E, CIPM
November 4, 2024

EU-US DPF Compliant Draft Privacy Policies
Assessing your program
Demonstrating compliance
Takeaways

In 2023, the introduction of the EU-US Data Privacy Framework (EU-US DPF) represented the re-instatement of a crucial mechanism for businesses aiming to transfer personal data from the EU to the US. One year on and the European Commission published its first review into the framework’s adequacy decision concluding that “the necessary structures and procedures to ensure that the Data Privacy Framework functions effectively” are in place. While obtaining certification against the EU-US DPF remains an important step for organizations wanting to transfer personal data across the Atlantic, the Commission’s report has highlighted that maintaining compliance with the framework’s principles is equally essential.

Throughout this blog we’ll explore three important areas of focus for companies looking to self-certify, or maintain compliance, with the EU-US DPF as highlighted by the report. In particular, we’ll look at drafting EU-US DPF compliant privacy policies ready for submitting to the Department of Commerce (DoC) and conducting self-assessments to evaluate whether your organization is effectively meeting the “recourse, enforcement, and liability”, “access”, “choice”, and “accountability for onwards transfer” principles.

EU-US DPF compliant draft privacy policies

As part of its report, the European Commission draws attention to the importance of creating a privacy policy that meets the requirements of the EU-US DPF. A draft privacy policy that satisfies the conditions of the framework is a foundational element of the application and certification process. This draft privacy policy must contain certain information about your data processing operations and is your opportunity to be transparent with individuals about how your company handles their personal information.

Key elements of an EU-US DPF compliant privacy policy

When preparing to self-certify with the framework a good starting place is to produce a comprehensive draft privacy policy that details all aspects of data collection, use, storage, and sharing. To comply with the conditions of the EU-US DPF, the draft privacy policy must include specific information relating to:

Categories of personal information: Clearly identify the types of personal information you collect. This could be basic contact details or more sensitive information such as race, sexual orientation, or health information.
A commitment to the EU-US DPF and its principles: Your policy must inform individuals about your participation in the framework. Additionally, the policy should include information that speaks to your commitment to the principles of the framework including, “choice”, “access”, and “security.”
Data usage and sharing: Describe how the data will be used and shared, including intended purposes and the third parties that data is shared with. This could include purposes such as internal use, marketing, or onward transfer to third parties.
Contact information and dispute resolution: Your policy should indicate how individuals can contact your organization to make an inquiry or complaint. It should also include information relating to the independent dispute resolution body designated to address complaints and provide appropriate recourse free of charge to the individual.
Individual rights: Inform individuals about their rights to access their information and how they can limit the use and disclosure of their information.
Enforcement: An EU-US DPF compliant privacy policy should inform individuals about whether your organization falls under the “investigatory and enforcement powers of the FTC, the DOT, or any other US authorized statutory body”

Download the checklist to understand the steps needed to self-certify and maintain compliance with the EU-US DPF.

How to self-assess your program against the “recourse, enforcement, and liability” principle

The "recourse, enforcement, and liability" principle is designed to provide data subjects with enforceable rights and ensure organizations are equipped with robust mechanisms for handling complaints. Feedback received by the European Commission has brought to light that organizations are turning to self-assessment or external reviews to ensure they’re maintaining compliance with this principle.

Understanding the “recourse, enforcement, and liability” principle

This principle requires your organization to provide mechanisms to ensure compliance with the EU-US DPF principles and offer individuals a resolution service to handle complaints about non-compliance. This includes establishing an independent recourse mechanism used to investigate complaints and disputes free of charge. Processes must also be put in place to follow up on your organization’s privacy practices to establish where remedy has been implemented in cases of non-compliance.

Conducting a self-assessment for compliance

A thorough self-assessment is one avenue outlined by the Commission for ensuring your program aligns with the enforcement and liability principle of the EU-US DPF. When approaching a task of this nature you can start by reviewing all internal processes related to complaint handling and ensuring you have proper documentation for dispute resolutions. Regularly audit these procedures to ensure that they work as intended and consider leveraging checklists or compliance management software to track each element of the recourse principle. Moreover, you must verify that the self-assessment has been completed via a statement signed by a corporate officer or other authorized representative of the organization at least once a year and made available upon request by individuals or in the context of an investigation or a complaint about non-compliance.

It’s sensible to regularly consult with privacy experts to confirm your company meets evolving legal standards and with stakeholders from different business functions to ensure that your organization is doing what is says it’s doing.

Demonstrating compliance with the “access”, “choice”, and “onward transfer” principles

These principles safeguard individuals’ rights to control their personal data, choose how it's shared, and ensure that third parties respect the same level of protection. As outlined by the Commission’s report, compliance with these principles comes under specific scrutiny from private-sector independent recourse mechanisms (IRMs) to the extent that organizations are subject to audits and random checks against these principles.

Complying with the access and choice principles

Under the EU-US DPF, individuals have the right to access their personal information and the ability to opt out of certain uses of their information. It’s important to understand how your organization grants individuals access to their personal information. To build this understanding you can first seek to implement processes that allow individuals to easily request and receive a copy of the personal data you hold. This could be through an online portal or by email, but the process should be efficient and - as a best practice - easy to navigate. You should then turn your focus to operationalizing effective choice mechanisms, ensuring they are readily available and affordable mechanism for data subjects to exercise their opt-out options, particularly for data sharing or use in secondary functions like marketing. As a best practice, you should also ensure these choices are easily accessible and that users can change their preferences simply.

Ensuring compliance with onward transfer rules

Onward transfer forms are an important area to consider under the EU-US DPF, especially if you share personal data with third-party service providers. To maintain compliance, it's essential to establish and document proper agreements with these third parties, establishing contracts that specifically reference onward data transfers. Such contracts must ensure that the third party will adhere to the same principles as your organization and those of the framework as well as detailing the security and privacy obligations of the third party. To verify third-party compliance with the framework, clauses should be included in contracts that allow your organization to monitor compliance. This will allow your organization to perform regular audits and ensure continued compliance with the requirements of the onward transfer principle. Your company must have measures in place to terminate relationships with non-compliant vendors swiftly.

Reflecting on the takeaways from the European Commission’s review

The European Commission’s first annual review into the adequacy decision of the EU-US DPF serves as a good reflection point for organizations hoping to self-certify, and for those who are looking to maintain compliance, with the framework. The report has highlighted several areas that should be considered following a year of the framework being in operation based on the findings of its participants, industry groups, and government departments involved in the framework’s implementation and development.

For organizations, focusing on creating a transparent privacy policy, conducting a thorough self-assessment, and ensuring compliance with the access, choice, and onward transfer principles, you will be able meet, maintain, and document some of the key requirements needed for participation in the framework.

OneTrust Privacy Operations features key capabilities that can help you develop, manage, and report on an EU-US DPF compliant privacy program. From privacy notice management to data flow mapping, OneTrust Privacy Operations equips you with the tools needed to streamline your privacy program activities and demonstrate accountability and transparency.

Download the checklist to understand the steps needed to self-certify and maintain compliance with the EU-US DPF or request a demo to speak to one of our experts.

Blog

EU-US DPF in review: Your next steps to self-certify and maintain compliance

Table of contents

EU-US DPF compliant draft privacy policies

Key elements of an EU-US DPF compliant privacy policy

How to self-assess your program against the “recourse, enforcement, and liability” principle

Understanding the “recourse, enforcement, and liability” principle

Conducting a self-assessment for compliance

Demonstrating compliance with the “access”, “choice”, and “onward transfer” principles

Complying with the access and choice principles

Ensuring compliance with onward transfer rules

Reflecting on the takeaways from the European Commission’s review

You may also like

Privacy Management

2024 to 2025: Preparing for the next wave of privacy regulations

Prepare for 2025's privacy changes with this recap webinar on 2024's regulations and explore upcoming laws, trends, and compliance strategies.

January 23, 2025

Privacy Management

Data Privacy Day 2025

Join this webinar to hear from a panel of expert privacy professionals as they dissect the key happenings in 2024 and how privacy professionals can approach what may occur in 2025.

January 21, 2025

Privacy Management

Emerging privacy laws in the Northeast: Key insights and compliance strategies

Join our webinar to explore key 2025 data privacy laws in the Northeast US, including New Jersey’s Senate Bill 332, New Hampshire Senate Bill 255, and Rhode Island's Data Data Transparency and Privacy Protection Act.

December 18, 2024

Consent & Preferences

Deliver hyper-personalized experiences with a privacy-first approach to first-party data

Download our infographic to earn how to navigate new privacy laws and deprecating cookies with Adobe CDP and OneTrust.

December 18, 2024

Third-Party Risk

Virtual Lunch and Learn: A deep dive into OneTrust's Third Party Management capabilities

Join us for a virtual Lunch & Learn session and explore how OneTrust’s Third Party Management solution can streamline your risk management processes.

December 17, 2024

Privacy Management

Revisiting IAPP DPC 2024: Top trends on the latest data protection developments

Join OneTrust and PA Consulting as we dive deeper into the key takeaways from the IAPP Europe Data Protection Congress 2024. Our speakers will provide actionable insights from the event on the latest developments in data protection, privacy, and AI.

December 12, 2024

Cookie Consent

How to handle opt-outs for tracking pixels under Australian privacy law

Join our webinar to learn how to master consent management and handle opt-outs for tracking pixels.

December 12, 2024

Responsible AI

Overcoming the privacy pitfalls of GenAI

This webinar will explore the key privacy pitfalls organizations face when implementing GenAI, focusing on purpose limitation, data proportionality, and business continuity.

December 10, 2024

Privacy Automation

GDPR: Dos and don'ts

Navigating GDPR compliance can feel daunting, especially for businesses with limited resources. This quick infographic guide of actionable “dos” and “don’ts” will help you develop the foundation of a broader privacy-first approach that keeps you aligned with your GDPR compliance goals.

December 10, 2024

Privacy Management

Privacy risk assessment workbook

December 10, 2024

Privacy Management

An overview of the Thailand Personal Data Protection Act

Download our infographic overview of Thailand's Personal Data Protection Act and get the basic facts on the scope, key definitions, data subject rights, and more on the data protection law.

December 10, 2024

Privacy Management

A quick guide to the Thai PDPA

Download our ebook on understanding the Personal Data Protection Act (PDPA), Thailand's first comprehensive data protection law, and get a quick guide on the legistation's requirements, definitions, and other key points.

December 10, 2024

Privacy Management

Staying equipped for compliance: A global recap of emerging privacy laws

November 20, 2024

Privacy Automation

From request to resolution: Simplifying DSRs with automation

Learn how OneTrust's Data Subject Rights (DSR) Automation solution can automate DSRs from intake through fulfillment including ID verification, data detection and deletion, redaction, and secure response.

November 06, 2024

Privacy Management

EU-US DPF self-certification and compliance checklist

November 04, 2024

Consent & Preferences

Chrome's new path for privacy

Explore our guide on Chrome's new privacy approach, covering cookie management changes, consumer behavior, and strategies for advertisers in a cookieless future.

October 31, 2024

Privacy Automation

Explore the future of regulatory intelligence: A DataGuidance demo

In this live demo webinar, we will showcase the advancements in regulatory intelligence embedded within the DataGuidance platform, which offers comprehensive and updated regulatory research across 300+ jurisdictions.

October 29, 2024

Privacy Management

How OneTrust partners with Artefact to enable responsible data strategies

 An overview of the Thailand Personal Data Protection Act 

OneTrust acknowledged as a Representative Vendor in the Gartner® Market Guide for Consent and Preference Management