On July 11, 2023, the U.S. International Trade Administration (ITA) issued an advisory following the European Commission's adequacy decision for the EU-US Data Privacy Framework (DPF).

Certification

The advisory reminds that the EU-US DPF Principles entered into effect on the same date and that organizations that have self-certified their commitment to comply with the EU-U.S. Privacy Shield Framework Principles, must update their privacy policies for compliance with the Principles by October 10, 2023.

However, organizations that have self-certified with the EU-US Privacy Shield do not need to make a separate, initial self-certification submission to participate in the EU-US DPF and may begin relying immediately on the EU-US DPF adequacy decision to receive personal data transfers from EU and EEA.

Notably, the Advisory outlines that the ITA will launch the DPF website to enable US-based organizations to make initial certification submissions to participate in the EU-US DPF, UK Extension to the EU-US DPF, and/or Swiss-US DPF on July 17, 2023. Organizations may also make their annual re-certification submission for the EU-US DPF, UK Extension to the EU-US DPF, and/or the Swiss-US DPF from the same date.

In addition, the ITA established that the Privacy Shield Website will be taken offline on July 14, 2023, but that individuals with active accounts for the Privacy Shield program will be able to use their existing login credentials for the DPF website.

UK

Eligible organizations that wish to self-certify their compliance to the UK Extension to the EU-US DPF may do so from July 17, 2023, but may not do so before the UK's adequacy regulations implementing the data bridge for the UK Extension to the EU-US DPF enter into force. The advisory clarifies that organizations that wish to participate in the UK Extension must also participate in the EU-US DPF.

Switzerland

The Swiss-US DPF Principles will enter into effect on July 17, 2023. Organizations that have self-certified their compliance with the Privacy Shield Framework Principles must comply with the Swiss-US DPF Principles including by updating their privacy policies by October 17, 2023. The advisory clarifies that such organizations may not begin relying on the Swiss-US DPF to receive personal data transfers from Switzerland until the date of entry into force of the Swiss Federal Administration's anticipated recognition of adequacy for the Swiss-US DPF.

You can read the advisory here and access the DPF website here.