June 28, 2023 | 10:00 am BST

The European Commission recently issued its draft adequacy decision on the EU-US Data Privacy Framework (EU-US DPF) following the invalidation of the Privacy Shield.  

The draft adequacy decision concludes that the legal framework in the US establishes an adequate level of protection for personal data transferred from the EU to US companies, ensuring that further safeguards are in place for the transfer of personal data of EU citizens out of Europe. 

Organizations looking to certify with the EU-US DPF will need to consider new and additional items covered in the Commission’s draft adequacy decision. These include ensuring that your privacy program encompasses a broader scope of personal data, amending privacy notices to an EU level of transparency, and ensuring your vendor contracts include new provisions of the EU-US DPF. 

Key Takeaways:

• Understanding the requirements of the new EU-US DPF 
• How you can update your privacy program to align with the framework 
• Operational tips and best practices for post-Schrems data transfers