DPF.

EU-US Data Privacy Framework, the July 2023 adequacy mechanism that replaces Privacy Shield for transatlantic transfers of personal data. It belongs to the Compliance & Frameworks category of cybersecurity.

EU-US Data Privacy Framework, the July 2023 adequacy mechanism that replaces Privacy Shield for transatlantic transfers of personal data.

The EU-US Data Privacy Framework (DPF) is a transatlantic data-transfer mechanism that allows participating US companies to receive personal data from the EU without additional safeguards under GDPR Chapter V. It is based on Executive Order 14086 (October 2022) and was formally recognised by the European Commission's adequacy decision of 10 July 2023, replacing the EU-US Privacy Shield invalidated by Schrems II in 2020. Eligible US organisations self-certify their compliance with the DPF Principles to the US Department of Commerce and remain subject to enforcement by the FTC or DOT. A UK extension and a Swiss-US DPF complement the EU-US framework. EU data subjects can submit complaints to a redress mechanism that includes the Data Protection Review Court (DPRC).

Defences for DPF typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: EU-US Data Privacy Framework, Trans-Atlantic Data Privacy Framework.