EU-US Data Privacy Framework: Self-Certification and Transfer Rules

The EU-US Data Privacy Framework (DPF) is the current mechanism that lets personal data flow from the European Union to certified companies in the United States. Since the European Commission's adequacy decision of 10 July 2023, a US organisation that self-certifies with the Department of Commerce can receive EU personal data without standard contractual clauses or transfer impact assessments for those transfers. The UK and Switzerland have linked arrangements.

The DPF replaced the Privacy Shield, which the Court of Justice struck down in 2020 in the Schrems II case. The EU General Court upheld the DPF in September 2025, but an appeal is pending at the Court of Justice, so its long-term future is not certain. This guide explains who can join, the principles, the certification process, recourse, the UK and Swiss extensions, the legal risks and how to keep a fallback.

What is the Data Privacy Framework?

The DPF is a set of privacy principles issued by the US Department of Commerce, combined with US commitments on intelligence access, which the European Commission found to provide an adequate level of protection under Article 45 of the GDPR. It works by self-certification: a US organisation publicly commits to the DPF Principles, and that commitment becomes enforceable under US law. EU exporters can then transfer data to that organisation as if it were in an adequate country, but only for the data types and purposes covered by its certification.

The US side included Executive Order 14086 of October 2022, which requires signals intelligence activities to be necessary and proportionate to defined objectives and created a two-step redress mechanism for EU individuals, ending with the Data Protection Review Court.

History: Safe Harbor, Privacy Shield and the Schrems cases

The DPF is the third attempt at an EU-US transfer framework. The Safe Harbor principles applied from 2000 until the Court of Justice invalidated the Commission's decision in October 2015, in a case brought by privacy activist Max Schrems, because US law allowed broad access to data by public authorities without adequate remedies. The EU-U.S. Privacy Shield replaced it in 2016, adding an ombudsperson and stronger commitments, but the Court invalidated it in July 2020 (Schrems II) for similar reasons: US surveillance programs were not limited to what was strictly necessary, and EU individuals lacked an effective remedy before an independent body.

The DPF responds to those two findings with Executive Order 14086, which introduced necessity and proportionality requirements for signals intelligence and the Data Protection Review Court. The commercial principles are largely carried over from Privacy Shield, so organisations that had certified before could transition quickly.

Who can join?

Only US organisations subject to the investigatory and enforcement powers of the Federal Trade Commission or the Department of Transportation are eligible. That covers most commercial companies, but excludes, for example, banks, insurers and telecom carriers regulated by other agencies, and nonprofits outside FTC jurisdiction. EU, UK or Indian companies cannot self-certify; their US subsidiaries can.

Is it mandatory or voluntary?

Joining is voluntary. Once certified, compliance with the principles is mandatory and enforceable by the FTC or DOT, and false claims of participation are deceptive practices. Organisations must recertify annually.

The DPF Principles

1. Notice: inform individuals about participation, types of data, purposes, rights, recourse, disclosures to third parties and the possibility of disclosure to public authorities.
2. Choice: offer opt-out for disclosure to third parties or use for materially different purposes, and opt-in for sensitive information.
3. Accountability for onward transfer: transfer to third parties only for limited, specified purposes under contracts that provide the same level of protection; the organisation stays liable for agents.
4. Security: reasonable and appropriate measures considering risks and the nature of the data.
5. Data integrity and purpose limitation: process data compatibly with collection purposes, keep it reliable, and retain it in identifiable form only as long as it serves a purpose.
6. Access: individuals can access their data and correct, amend or delete inaccurate or unlawfully processed data.
7. Recourse, enforcement and liability: independent recourse mechanisms, verification procedures, remedies, and binding arbitration as a last resort.

Sixteen supplemental principles add detail on sensitive data, journalism, secondary liability, due diligence and audits, human resources data, contracts for onward transfers, dispute resolution, verification, access, travel information, pharmaceutical and medical products, and public record information.

Self-certification process

1. Confirm eligibility under FTC or DOT jurisdiction.
2. Develop a DPF-compliant privacy policy that names participation, links to the DPF website and the recourse mechanism, and describes the required elements.
3. Choose an independent recourse mechanism: a private dispute resolution provider, free to individuals, or cooperation with EU data protection authorities. For HR data, cooperation with the EU DPA panel is mandatory.
4. Put in place a verification mechanism, through self-assessment or outside compliance review.
5. Designate a contact for complaints and access requests.
6. Submit the self-certification on the DPF website and pay the annual fee, which varies by revenue.
7. Recertify every year and keep the privacy policy aligned.

The certification must state which data it covers: non-HR data about customers, users and contacts, HR data about employees in the context of employment, or both. Different commitments apply to each, especially for recourse. Organisations appear on the public DPF List, which exporters check before relying on the framework. Withdrawing requires notice and continued protection for data already received.

Recourse for individuals

EU individuals can complain directly to the organisation, which must respond within 45 days; to the independent recourse mechanism at no cost; to their national data protection authority, which can refer to the Department of Commerce or FTC; or, as a last resort, invoke binding arbitration through the DPF panel. Complaints about US intelligence access go through national DPAs to the Civil Liberties Protection Officer and then the Data Protection Review Court.

UK Extension and Swiss-U.S. DPF

The UK Extension to the EU-U.S. DPF, often called the UK-US data bridge, applies from 12 October 2023 under UK regulations. US organisations must first certify to the EU-U.S. DPF and then opt into the UK Extension. The Swiss-U.S. DPF is a separate certification, recognised by Switzerland as adequate from 15 September 2024. An organisation can certify to all three in one process.

Legal challenges and risks

Two earlier frameworks were invalidated: Safe Harbor in 2015 (Schrems I) and Privacy Shield in 2020 (Schrems II). The DPF has been challenged too. In Latombe v Commission, the General Court dismissed an action for annulment on 3 September 2025, finding that the US offered adequate protection at the time of adoption. The applicant appealed to the Court of Justice in October 2025 (Case C-703/25 P), and the appeal was still pending in October 2026. Concerns have also been raised about the independence of US oversight bodies, including the Privacy and Civil Liberties Oversight Board, after several members were removed in January 2025. The Commission conducted its first periodic review in 2024 and continues to monitor the framework.

If the DPF were invalidated or suspended, transfers relying on it would need another mechanism, usually standard contractual clauses with transfer impact assessments. Some authorities have advised organisations to prepare exit strategies.

Fallback mechanisms

• EU standard contractual clauses (2021) with a transfer impact assessment, usually already in vendor data processing agreements.
• UK International Data Transfer Agreement or Addendum for UK transfers.
• Binding corporate rules for intra-group transfers.
• Technical measures, such as encryption with keys held in the EU, pseudonymisation and EU data residency, which reduce exposure whatever the legal mechanism.

Many vendors already include SCCs in their DPAs that apply automatically if the DPF ceases to be valid.

Transfer impact assessments and what the DPF removes

After Schrems II, EU exporters using standard contractual clauses had to carry out transfer impact assessments, analysing whether the law and practice of the destination country could undermine the clauses and adding supplementary measures where needed. For US transfers, this meant reviewing laws such as Section 702 of the Foreign Intelligence Surveillance Act. The safeguards in Executive Order 14086 apply to all transfers to the US, whatever the mechanism, so the European Data Protection Board and the Commission have indicated that they can be taken into account in assessments for SCC-based transfers too. For transfers to a DPF-certified organisation covered by its certification, no transfer impact assessment is needed, because the adequacy decision already covers the destination.

Obligations that stay with EU exporters

The DPF only addresses the transfer step. An EU organisation sending data to a certified US vendor must still have a lawful basis for the processing, sign a data processing agreement under Article 28 of the GDPR where the vendor is a processor, tell individuals about the transfer in its privacy notice, and check that the vendor's certification is active and covers the right data. It also remains responsible for the vendor's onward transfers to subprocessors, including any in third countries such as India, which need their own mechanism.

What EU customers check

• That the US vendor appears on the DPF List with an active status, covering the relevant data type (HR or non-HR).
• That the vendor's privacy policy and DPA reference the DPF.
• Subprocessors and their transfer mechanisms.
• Fallback clauses and data residency options.
• Security evidence such as SOC 2 or ISO/IEC 27001.

How to comply, step by step

1. Decide whether certification is worth it based on EU, UK and Swiss customer demand.
2. Map EU data flows and the types of data received, including HR data.
3. Update the privacy policy with all required DPF elements.
4. Sign up with a recourse provider and set up verification.
5. Review onward transfer contracts with subprocessors.
6. Self-certify for the EU-U.S. DPF and, if needed, the UK Extension and Swiss-U.S. DPF.
7. Keep SCCs in DPAs as a fallback.
8. Recertify annually and monitor legal developments.

Documentation you will need

• DPF-compliant privacy policy.
• Self-certification submission and annual recertification records.
• Recourse mechanism agreement.
• Verification records (self-assessment or external review).
• Onward transfer contracts.
• Complaint and access request logs.
• Fallback SCCs and transfer impact assessments.

Timeline and cost considerations

A US company with a mature privacy program can self-certify within a few weeks. Costs include the annual Department of Commerce fee, the recourse provider fee, legal review of the privacy policy, and internal effort for verification. Compared with negotiating SCCs and transfer impact assessments with each EU customer, certification usually saves time.

Common mistakes

• Lapsed certification while still claiming participation, which the FTC treats as deceptive.
• Not certifying for HR data when receiving EU employee data.
• Privacy policy missing required elements.
• Onward transfers without contracts.
• No fallback mechanism.
• Assuming DPF removes GDPR obligations; EU exporters still need a legal basis and must meet all other GDPR rules.

Best practices, tools and technologies

• Offer EU data residency for customers who prefer it.
• Encrypt data with customer or EU-held keys where practical.
• Maintain a public subprocessor list with transfer mechanisms.
• Automate access and deletion requests.
• Track DPF List status and recertification dates in your compliance calendar.
• Structure privacy controls with ISO/IEC 27701.

We build data residency options, deletion workflows and secure APIs into SaaS platforms through our SaaS product and API integration services.

How the DPF relates to other frameworks

Framework	Relationship
GDPR	The DPF is an Article 45 adequacy route for transfers under the GDPR.
UK GDPR	The UK Extension provides the UK equivalent.
CCPA/CPRA	Separate US state obligations still apply to certified companies.
SOC 2	Security evidence European customers request alongside DPF status.

Real-world example

A US-based HR analytics SaaS with engineering in India sells to German and UK employers. It certifies to the EU-U.S. DPF, the UK Extension and the Swiss-U.S. DPF for both HR and non-HR data, agrees to cooperate with the EU DPA panel for HR complaints, lists its Indian development subsidiary as a subprocessor under a contract with DPF-equivalent protections, keeps SCCs in its DPA as a fallback, and offers EU hosting for customers who want data to stay in Europe.

Next steps

1. Check eligibility under FTC or DOT jurisdiction.
2. Update your privacy policy.
3. Choose recourse and verification mechanisms.
4. Self-certify and add the UK and Swiss components if needed.
5. Keep a fallback and monitor the Court of Justice appeal.

Frequently asked questions

What is the EU-US Data Privacy Framework?

An adequacy-based mechanism allowing EU personal data to be transferred to US organisations that self-certify to the DPF Principles.

Who can self-certify?

US organisations under the jurisdiction of the FTC or the Department of Transportation, which covers most commercial companies but not banks or telecom carriers.

Is the DPF still valid?

Yes. The General Court upheld it in September 2025, but an appeal is pending at the Court of Justice.

Do I still need SCCs if my US vendor is certified?

Not for transfers covered by the vendor's certification, but keeping SCCs as a fallback is common.

How often must organisations recertify?

Every year.

Does the DPF cover the UK?

Through the UK Extension, which US organisations can join after certifying to the EU-U.S. DPF.

Can an Indian company join the DPF?

No, only US organisations can; an Indian company's US subsidiary could.

What happens if the DPF is invalidated?

Transfers would need another mechanism, usually SCCs with transfer impact assessments.

Is there an audit for DPF certification?

No third-party audit is required; organisations verify through self-assessment or outside review and are subject to FTC or DOT enforcement.

How do individuals complain?

To the organisation, a free independent recourse mechanism, their data protection authority, or binding arbitration as a last resort.

What replaced Privacy Shield?

The EU-U.S. Data Privacy Framework, effective 10 July 2023.