{"id":3789,"date":"2024-03-14T16:49:19","date_gmt":"2024-03-14T22:49:19","guid":{"rendered":"https:\/\/trustarc.com\/?post_type=regulations&p=3789"},"modified":"2024-03-21T13:09:07","modified_gmt":"2024-03-21T19:09:07","slug":"data-privacy-framework-dpf","status":"publish","type":"regulations","link":"https:\/\/trustarc.com\/regulations\/data-privacy-framework-dpf\/","title":{"rendered":"Data Privacy Framework (DPF)"},"content":{"rendered":"\t\t
\n\t\t\t
\n\t\t\t\t\t\t\t\t\tRegulation<\/span>\n\t\t\t\t\t\t\t\t\t\t

Data Privacy Framework (DPF)<\/h1>\n\t\t\t\t\t

The EU-U.S. DPF, UK Extension to the EU-U.S. DPF, and Swiss-U.S. DPF was developed by the U.S. Department of Commerce and the European Commission, UK Government, and Swiss Federal Administration to provide U.S. organizations with reliable mechanisms for personal data transfers to the United States from the European Union, United Kingdom, and Switzerland while ensuring data protection that is consistent with EU, UK and Swiss law.<\/p>\n\t\t\t<\/div>\n\t\t<\/section>\n\t\t\n\n\t\t

\n\t\t\t
\n\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t

Who is eligible to participate in the DPF Program?<\/h2>\n

To be eligible to participate in the DPF, an organization must be subject to the investigatory and enforcement powers of the Federal Trade Commission (FTC) or the U.S. Department of Transportation (DoT).<\/p>\n

The FTC’s jurisdiction covers acts or practices in or affecting commerce by any “person, partnership, or corporation.” The FTC does not have jurisdiction over most depository institutions (banks, federal credit unions, and savings & loan institutions), telecommunications, interstate transportation, common carrier activities, air carriers, labor associations, most non-profit organizations, and most packer and stockyard activities.<\/p>\n\t\t\t\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\n\n\t

\n\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t

Key obligations under the Data Privacy Framework<\/h2>\n\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t

Purpose limitation & choice<\/h4>\n

Personal data should be processed lawfully and fairly. It should be collected for a specified purpose and should not be processed in a way that is incompatible with the purpose for which it was originally collected or authorized by the individual. <\/p>\n

Provide data subjects with a mechanism to exercise choice in relation to the use or disclosure of their personal information.<\/p>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t\t\t\t\t

\n\t\t\t\t\t\t\t

Policies & notices<\/h4>\n

Data subjects should be informed of the main features of the processing of their personal data. Provide clear and conspicuous notice(s) about the practices and policies that govern the personal information.<\/p>\n

The Privacy Notice must inform individuals of the organization\u2019s participation in the EU-U.S. DPF and, as applicable the UK Extension to the EU-U.S. DPF, and\/or the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) and provide a link to, or the web address for, the Data Privacy Framework List.<\/p>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t<\/section>\n\t\n\n\t

\n\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t

Data subject rights & requests<\/h4>\n

Data subjects should have certain rights which can be enforced against the controller or processor, in particular the right of access to data, the right to object to the processing and the right to have data rectified and erased.<\/p>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t\t\t\t\t

\n\t\t\t\t\t\t\t

Sub-processing<\/h4>\n

In the case of sub-processing, a processor must conclude a contract with the sub-processor guaranteeing the same level of protection as provided by the DPF Principles and take steps to ensure its proper implementation.<\/p>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t<\/section>\n\t\n\n\t

\n\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t

Accountability for onward transfers<\/h4>\n

To transfer personal data to a third party acting as a controller, the organizations must execute a contract requiring them to apply the same level of protection, use the data for specified purposes, and notify if they cannot meet their obligations under the DPF.<\/p>\n

To transfer personal data to a third party acting as an agent, the organization must transfer such data only for limited and specified purposes. Contracts must be in place with processors requiring them to provide the same level of privacy protections, ensure that the agent effectively processes the personal data transferred in a manner consistent with the organization\u2019s obligations under the DPF, notify the controller if it can no longer meet its requirements, upon notice of unauthorized processing, the processor must take reasonable and appropriate steps to stop and remediate the unauthorized processing.<\/p>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t<\/section>\n\t\n\n\t\t

\n\t\t\t
\n\t\t\t\t\"\"\t\t\t<\/div>\n\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\tWebinar<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t

Everything you need to know about EU-US DPF but are afraid to ask<\/h2>\n\t\t\t\t\t\t\t\t\t\t\t\t