Self-certify to the DPF and keep transatlantic data flowing

The EU-U.S. Data Privacy Framework (DPF) is a self-certification programme run by the U.S. Department of Commerce. U.S. organisations publicly commit to seven Principles and sixteen Supplemental Principles, and in return EU exporters can send them personal data without standard contractual clauses. The European Commission adopted its adequacy decision for the DPF on 10 July 2023, replacing the Privacy Shield, which the Court of Justice invalidated in 2020.

The UK Extension, often called the UK-US data bridge, extends the DPF to personal data transferred from the United Kingdom. Under the Data Protection (Adequacy) (United States of America) Regulations 2023, UK organisations have been able to send personal data to U.S. organisations certified under the UK Extension since 12 October 2023 without further safeguards. A U.S. organisation can only join the UK Extension if it also participates in the EU-U.S. DPF.

Only U.S. organisations subject to the investigatory and enforcement powers of the Federal Trade Commission or the U.S. Department of Transportation can self-certify. That covers most commercial businesses, but excludes some sectors, such as many banks and other organisations outside those agencies' jurisdiction. Participation is voluntary, but once an organisation certifies, its commitment to the Principles is enforceable under U.S. law.

A certified organisation that fails to follow the Principles can face enforcement action by the Federal Trade Commission or Department of Transportation for unfair or deceptive practices, and can be removed from the DPF List. Individuals can also complain through the organisation's independent recourse mechanism and, as a last resort, binding arbitration. Claiming DPF participation without being certified, or after certification lapses, is itself a misrepresentation regulators can act on.

A company self-certifies through the International Trade Administration's Data Privacy Framework website. It must publish a privacy policy that conforms to the Principles, choose an independent recourse mechanism, pay the annual fee, identify a contact for complaints, and have the measures in place to comply before it certifies. Certification must be renewed every year to stay on the DPF List.

The DPF is a transfer mechanism, not a replacement for GDPR or UK GDPR. EU and UK exporters still need a lawful basis and must meet all other obligations; the DPF simply provides the adequacy route for sending data to a certified U.S. recipient. For UK exporters, government guidance says sensitive data, such as genetic, biometric or criminal offence data, should be flagged to the U.S. recipient so it is protected as sensitive.

No. The DPF is a privacy commitment covering how personal data is collected, used, shared and protected, whereas ISO 27001 and SOC 2 are information security frameworks with independent audits. They overlap on the Security Principle, which requires reasonable and appropriate measures to protect personal data, so evidence from an existing ISO 27001 or SOC 2 programme can support DPF compliance.

Yes. The DPF is supported in OneClickComply today. We help you map the Principles to your controls, generate policies, collect evidence and prepare for annual recertification. OneClickComply does not certify organisations: self-certification is made by your organisation to the U.S. Department of Commerce, and our auditors can review your readiness through Ask an Auditor.