An Explanation of Annual Recertification and Verification Under the Data Privacy Framework

Since the introduction of the new Data Privacy Framework (DPF) on July 17, 2023, many have begun familiarizing themselves with its seven principles as they ready themselves to comply. However, the DPF also features 16 supplemental principles, two of which—regarding self-certification and verification—also cover particularly important topics.

As the DPF will replace the prior Privacy Shield program, organizations will need to adjust and prepare to comply with all these principles. That being said, as privacy experts with a dedicated practice, we’ve been reviewing a lot of the questions coming in from our clients and other companies, and a trend emerged regarding those two supplemental principles.

To address these concerns for those asking the questions and everyone else, we’re going to dive into the two supplemental principles of self-certification and verification within the Data Privacy Framework.

What is the Data Privacy Framework?

According to the Federal Trade Commission, the DPF is a “new voluntary Framework, which replaces the Privacy Shield program [and] provides a mechanism for companies to transfer personal data from the EU to the United States in a privacy-protective way consistent with EU law.”

Within this new cornerstone for a transatlantic economic relationship, seven principles underpin this framework, and they include:

1. Notice
2. Choice
3. Accountability for Onward Transfer
4. Security
5. Data Integrity and Purpose Limitation
6. Access
7. Recourse, Enforcement and Liability

16 supplemental principles within the DPF cover a variety of privacy topics:

2 Key Supplemental Principles of the Data Privacy Framework

And while organizations seek to strengthen consumer privacy protections by adhering to all these principles, there are two in particular to make critical note of when familiarizing yourself with the requirements.

1. Self-Certification Principle (#6)

While it only briefly touches on the scope of the self-certification and whether it speaks to HR or non-HR data, this supplemental principle focuses on how organizations should self-certify to the Data Privacy Framework, including a lot of key details regarding:

• How the Department of Commerce will handle your certification; as well as
• How any changes to your organization’s certification in the future will be handled.

Self-certification itself involves a public declaration on the DPF website of your intentions to comply with DPF Principles, at which point your organization should be in accordance with the core Principles, but some important clarifications for this supplemental principle include:

• Upon self-certification, all your assurances must be in place and your policies, complaint mechanisms, and other controls are required to be operational.
• The day your organization is listed on the Data Privacy Framework List is the day you’ll begin to reap the benefits of adherence to the DPF.
• There is an annual re-certification requirement and dates are important—your organization will be removed from the list if the re-certification is not received in a timely manner.
• You must apply the DPF principles and underlying processes to any personal data collected under the mechanism for the life of the personal data in your organization’s systems—meaning that, if your organization undergoes a merger or an acquisition—or even leaves the DPF—you’re required to either:
  1.  “Put in place other safeguards, such as a written agreement that will ensure continued application of the Principles to any personal data that the organization received under the EU-U.S. DPF and will be retained;” or
  2.  Promptly delete or return all personal data collected and processed during the timeframe of the valid DPF certification.

(This is especially important for organizations where data has become paramount for business advancement and ongoing operations, because anyone wishing to wash their hands of the Data Privacy Framework for good may be required to expunge months, if not years, of data from their systems without offering similar protections.)

• If your organization leaves the DPF, you’re required to immediately cease using the DPF certification mark and all statements implying its ongoing participation—failure to do so will result in actions being taken by the DOC, FTC, or other agencies.

2. Verification Principle (#7)

Some organizations may view the Data Privacy Framework as an easily attainable self-certification that requires little to no oversight year-over-year. But make no mistake, that would be in direct contrast to the supplemental principle of verification, which states that:

“Organizations must provide follow-up procedures for verifying that the attestations and assertions they make about their EU-U.S. DPF privacy practices are true and those privacy practices have been implemented as represented and in accordance with the Principles.”

Regarding these required “follow-up [verification] procedures,” the framework allows for two options:

• Self-assessment; or
• Outside compliance reviews. 

It’s important to note that this self-assessment option for verification differs from the aforementioned “self-certification”—the latter is merely a public commitment of your organization’s intentions to maintain the DPF framework, whereas the verification self-assessment requires a signed statement by an authorized representative of your organization after an actual demonstration that:

• Your privacy policy regarding personal information received from the EU conforms to the Principles, and you’re complying with it.
• You have procedures in place for the handling of complaints, training employees in DPF implementation, and the periodic conducting of objective reviews of compliance. 

Both verification options are required to be performed annually, though one thing to note is that this supplemental principle specifically calls out that you should be conducting periodic objective reviews of compliance—whether you go for external verification or not.

Given that, plus the requirement that the review be objective, the self-assessment route is only advisable if you truly have:

• The in-house legal, IT, and business competencies to map out what needs to be implemented.
• The expertise and resources to develop and carry out the verification procedures necessary, whether from your internal audit function or another business unit not directly involved with the implementation and monitoring of your organization’s DPF program.
  • Keep in mind that the personnel involved in the verification review—whether from your internal audit unit or otherwise—would still require competencies related to the subject matter to adequately document and validate the effectiveness of your control framework that upholds the Data Privacy Framework principles.

 (With all those resource considerations, smaller businesses will likely need to have an outside compliance review performed.)

On the other hand, most of the privacy principles in the DPF are also present in other privacy regulations and frameworks. As such, you may already be testing many of the controls needed to satisfy the principles and requirements of the DPF during your other compliance efforts—if that’s the case, opting for external verification may make more sense. (We recommend overlapping verification wherever feasible to alleviate additional efforts and fees incurred in the long run).

Moving Forward with the Data Privacy Framework

Adjusting to the DPF—whether you operated under the prior Privacy Shield or not—will require bringing your organization into compliance with the framework’s seven core principles and its 16 supplemental principles. Two of those—self-certification and verification—will be critical for any organization that seeks to obtain and maintain the benefits that come with appearing on the DPF list.

 If you’re interested in learning more about adding DPF to your ongoing compliance efforts and how to gain efficiencies when doing so—or if you have any further questions regarding the framework in general—please feel free to contact us so that our team can address your concerns and ease your compliance burden as much as possible.