Key Dates for EU-U.S. Data Privacy Framework

The Department of Commerce's International Trade Administration has issued an update with specific dates relating to the new EU-U.S. Data Privacy Framework (DPF): 

• Effective Date: The DPF Principles went into effect as of July 10, 2023, the same day of the European Commission's adequacy decision. 
• Updates to Privacy Notices: For organizations that were already self-certified under the EU-U.S. Privacy Shield, they have until October 10, 2023 to update their privacy notices and comply with the EU-U.S. DPF Principles. Note that this doesn't change any recertification due dates. 
• New Certifications: The new DPF website www.dataprivacyframework.gov will be launched on July 17, 2023 and eligible organizations who wish to newly self-certify under the DPF can do so on this date. 
• UK: Organizations can also certify under the UK Extension to the DPF on July 17, 2023, but they cannot rely on the UK Extension until the UK regulators provide an adequacy decision.
• Switzerland: Organizations can also certify under the Swiss-U.S. Data Privacy Framework on July 17, 2023, but they cannot rely on the Swiss-U.S. Data Privacy Framework for data transfers until the Swiss regulators provide an adequacy decision. Organizations will also need to update their privacy notices for compliance with the Swiss-U.S. Data Privacy Framework by October 17, 2023. 
• Privacy Shield Website: This will be brought down on July 14, 2023 at 9:00 PM EST in preparation of the new DPF website described above. Accounts will be transferred over to the new website, but the old privacyshield@trade.gov email address should no longer be used and is being replaced with dpf.program@trade.gov.