Best Practices: Managing EU-US DPF Compliance in the OneTrust Platform

Our available attribute sets are now mapped to the DPF Principles across the relevant Data Mapping Inventories, such as Process and Asset. This enables customers to activate these attributes when the EU-US DPF is selected as the framework and within the Inventory Manager, making it easier for US businesses that self-certify under the framework to maintain detailed records of their conformity with the DPF requirements and periodically reassess their adherence.

Furthermore, Vendor inventory manager attributes have been updated to track adherence to the EU-US DPF framework, including the status, privacy notice link, and related aspects.

Our Privacy Shield Readiness Assessment Template has been updated to reflect recent changes in US legal regulations and the EU-US DPF Adequacy decisions.

The questionnaire is designed to be used as an audit checklist, to identify gaps in preparation for self-certification under the EU-US DPF. It can also be used to assist with meeting verification requirements under Supplemental Principle III.7 of the EU-US DPF.

This readiness assessment would be more relevant to organizations who would like to participate in the EU-US DPF and are not actively certified under the EU-US Privacy Shield.

If an organization is currently actively certified under the EU-US Privacy Shield, such organizations may begin to rely on the EU-US DPF if they are compliant. There are however updates required in terms of references to the updated frameworks and privacy notice updates.

Our GDPR Transfer Impact Assessment and the UK ICO Transfer Risk Assessment Templates have been updated to reflect recent changes in US legal framework and the EU-US DPF Adequacy decision approval. With these updates, our customers can easily track whether a data importer is self-certified under the DPF and can, therefore, rely on the EU-US adequacy decision or the UK extension.

Additionally, for organizations transferring data to US-based importers that cannot or will not join the DPF, the updated template includes a dedicated paragraph summarizing the main relevant aspects and developments under the US legal regime, including Executive Order 14086, which led the US International Administration to create the new DPF Program, and the European counterparties to declare adequacy.

Our OnePIA and OneVendor Templates have been updated to account for the EU-US DPF Adequacy decision approval as part of the data transfers sections. With these updates, our customers can easily track whether assessed organizations are self-certified under the DPF and can, therefore, rely on the approved Adequacy Decision.

OnePIA Template

OneVendor Template

Our current Privacy Shield Notice template has been recently updated to align with the EU-US DPF. With these updates, we aim to provide our customers with a comprehensive instrument to comply with the Notice Principle and to inform individuals about their privacy practices in a clear and concise manner.

We have designed a template model to accommodate the unique needs and preferences of different organizations. The template offers a structured approach, providing comprehensive legal guidance that outlines all the essential content required for the notice, leaving the notice fields in blank to be fully customized.

The updated template follows all requirements set forth by the Notice Principle in the EU-US DPF, ensuring that it contains all necessary elements to inform individuals properly. The update also aims to facilitate the self-certification process for our customers, as we have also included best practices recommendations. This ensures that our customers are well-prepared and can confidently proceed with the self-certification process under the EU-US DPF.

Additional Resources

For more information on how to manage EU-US DPF compliance and personal data transfers with the OneTrust Platform, please see the following articles:

• Transfers and Contextual Relationships: Feature Guide

• Data Transfers and Contextual Relationships Overview Webinar