List of DPF-certified companies has been published

On 10 July 2023 the new adequacy decision between the European Union and the United States, the so-called “Data Privacy Framework” (DPF), entered into force. This new framework agreement represents a significant step in transatlantic data protection rules, in that it enables EU companies to transfer personal data to data importers in the United States. US companies can now certify by demonstrating conformity with the DPF principles. A transfer of personal data to the listed companies can henceforth take place without further authorisations or additional measures such as Standard Contractual Clauses (SCCs) and Binding Corporate Rules (BCRs).

The official list of DPF-certified companies has now been published and can be viewed here: https://www.dataprivacyframework.gov/s/participant-search. The certified companies include, among others, large technology companies such as Google and Microsoft.

This has direct implications for your company. If you pass personal data on to certified companies, the privacy notices stored on your websites must be updated. The data transfer is now based on the DPF and no longer on the EU Standard Contractual Clauses (SCCs).