EU-US Data Privacy Framework: Self-Certification Guide

Eligibility turns on regulator jurisdiction: the organization must be subject to the FTC's Section 5 authority or the Department of Transportation's parallel authority over air carriers and ticket agents, because DPF enforcement runs through those agencies. That excludes most banks, savings institutions, and credit unions (prudential regulators), insurance companies (state regulation, McCarran-Ferguson), telecommunications common carriers for their carrier activities, and most nonprofits (outside FTC jurisdiction). Excluded entities transferring EU data must use standard contractual clauses or binding corporate rules instead. Within eligible companies, certification is entity-scoped: you declare which US entities and subsidiaries are covered, and coverage claims beyond the declared scope are themselves deceptive. HR data is a separate election: certifying for human resources data adds an obligation to cooperate with EU data protection authorities and follow their advice, so certify for HR only if you accept DPA cooperation.

Seven principles plus sixteen supplemental ones. Notice: a privacy policy declaring DPF participation, data types, purposes, third-party disclosures, individual rights, and the independent recourse mechanism, before or at collection. Choice: opt-out for disclosures to third parties or materially different uses; opt-in for sensitive data. Accountability for onward transfer: contracts with recipients limiting processing to specified purposes and requiring the Principles' level of protection, with the certifier remaining liable for its agents' processing unless it proves it is not responsible for the harm. Security: reasonable and appropriate measures. Data integrity and purpose limitation: relevance, reliability, and retention only while serving a processing purpose. Access: individuals can obtain, correct, amend, or delete inaccurate or Principle-violating data. Recourse, enforcement, liability: the free independent dispute-resolution mechanism, annual self-assessment or outside compliance review, and binding arbitration availability. The supplemental principles handle specifics: journalists, pharmaceutical research, publicly available data, and the HR rules.

Via dataprivacyframework.gov: organization details and a corporate officer's attestation; the covered entities list; the privacy policy URL (the policy must already conform, declaring DPF adherence, both DPF and, if elected, UK Extension and Swiss-US coverage, the recourse mechanism, FTC or DOT jurisdiction, and arbitration availability); designation of an independent recourse mechanism (a private provider such as those run by BBB National Programs or JAMS, or EU DPAs for HR data) with proof of registration; verification method (self-assessment or outside review); a contact for complaints; and the fee tiered to revenue. ITA reviews for completeness, not substance, approval confirms the paperwork, not compliance. Effective on placement on the DPF List. Two timing rules matter: do not claim participation before listing, and the Principles bind you to data received under the DPF for as long as you retain it, even after withdrawal, unless you return, delete, or provide 'adequate' protection by other means and affirm this annually to ITA.

Three layers. ITA administration: monitors the List, checks recertification lapses, demands removal of participation claims from lapsed certifiers, and refers persistent claims to the FTC. FTC enforcement: false or misleading framework-participation claims are straightforward Section 5 deception (the FTC brought dozens of such cases under Privacy Shield and its predecessors, and continued the pattern under DPF); substantive Principle violations attached to a public commitment are equally actionable, with consent orders typically running 20 years and imposing compliance reporting. Individual recourse: complaints go first to the organization (45-day response requirement), then the independent recourse mechanism, then, for unresolved claims, individuals may invoke binding arbitration before the DPF Panel, whose awards are enforceable in US courts. For national-security access complaints, EU individuals route through their DPA to the Civil Liberties Protection Officer, with appeal to the Data Protection Review Court, the EO 14086 machinery on which the adequacy decision rests. The practical exposure ranking: lapsed-certification misrepresentation first, notice/choice gaps second, onward-transfer contract gaps third.

Most sophisticated importers run both. The DPF's advantages: no transfer impact assessments for the certified flows (adequacy covers the government-access question), simpler operations than SCC module management, and a marketing signal EU customers recognize. Its risks: legal challenge, Latombe v. Commission sought annulment and the General Court dismissed it in September 2025, but appeal routes and a future Schrems-style challenge remain possible, and adequacy decisions can be suspended or repealed if US practice changes (the Commission reviews periodically, and EU parliamentarians have questioned the DPRC's independence after 2025 US governmental changes). SCCs' advantages: contract-based, survive adequacy invalidation, cover non-DPF-eligible entities and flows. Their cost: transfer impact assessments and clause administration. The layered posture: certify to the DPF for eligible flows, keep SCCs executed or executable as fallback (as most did through the Privacy Shield collapse), and document which mechanism governs which flow so an adequacy shock is a switch, not a scramble.