# EU-US DPF Assessment Workflow Reference

## Pre-Transfer Verification Workflow

### Step 1: Confirm Transfer Scope Applicability

1. Identify the personal data categories to be transferred (HR data, customer data, or both).
2. Confirm the US recipient organisation is subject to FTC or DoT jurisdiction.
3. Verify the transfer falls within the scope of the adequacy decision (i.e., to a self-certified entity, not to the US government or a non-certified entity).

### Step 2: DPF List Verification

1. Navigate to dataprivacyframework.gov and search for the importer by organisation name.
2. Confirm the following fields in the DPF listing:
   - **Status**: Must show "Active" (not "Not Current" or "Inactive")
   - **Certification date**: Note the original certification date
   - **Re-certification date**: Confirm the certification has not expired
   - **Data categories covered**: Verify the listing covers "HR Data" if employee data is transferred, and/or "Non-HR Data" for customer/commercial data
   - **IRM**: Note the independent recourse mechanism listed
3. Take a screenshot or save a PDF of the DPF listing as evidence for the transfer register.
4. Set a calendar reminder 30 days before the importer's re-certification expiry to re-verify active status.

### Step 3: Privacy Policy Review

1. Access the importer's privacy policy at the URL listed on the DPF entry.
2. Verify the policy explicitly references compliance with the EU-US Data Privacy Framework Principles.
3. Confirm the policy addresses all seven DPF Principles: Notice, Choice, Accountability for Onward Transfer, Security, Data Integrity and Purpose Limitation, Access, and Recourse/Enforcement/Liability.
4. Document any gaps or concerns.

### Step 4: Transfer Register Documentation

1. Record the transfer in the data transfer register with the following fields:
   - Data exporter identity
   - Data importer identity and DPF List entry URL
   - Transfer mechanism: "EU-US DPF Adequacy Decision (EU) 2023/1795"
   - DPF certification status and expiry date
   - Data categories transferred
   - Re-verification schedule
   - Backup mechanism (SCCs reference if maintained)
2. Attach the DPF List verification evidence.

## Self-Certification Workflow (For US Organisations)

### Phase 1: Readiness Assessment (Weeks 1-4)

1. Confirm FTC or DoT jurisdiction applies to the organisation.
2. Conduct a gap analysis of current privacy practices against the seven DPF Principles.
3. Identify all personal data received from EU/EEA data subjects and map processing activities.
4. Assess onward transfer arrangements with third-party controllers and processor agents.
5. Review and update the privacy policy to address all DPF Principle requirements.

### Phase 2: Infrastructure Setup (Weeks 3-6)

1. Select and engage an independent recourse mechanism (IRM):
   - Free mechanisms available through the DPF Annex I arbitration panel for individual disputes
   - Commercial IRMs include JAMS, BBB National Programs, and TRUSTe/TrustArc
   - For HR data: commit to cooperate with EU DPA panel
2. Designate the DPF compliance contact person and publish their details.
3. Implement or verify complaint handling procedures accessible to EU data subjects.
4. Establish the annual compliance verification mechanism (self-assessment or outside compliance review).

### Phase 3: Application Submission (Week 6)

1. Create an account at dataprivacyframework.gov.
2. Complete the self-certification application form providing:
   - Organisation name, address, and contact details
   - Privacy policy URL
   - DPF compliance contact
   - IRM details
   - Data categories covered (HR, non-HR, or both)
   - FTC/DoT jurisdiction confirmation
3. Submit the required fee payment.
4. Submit the application.

### Phase 4: DoC Review (Weeks 6-10)

1. DoC reviews the application for completeness and privacy policy compliance.
2. Respond to any DoC queries within the requested timeline.
3. Upon approval, the organisation is listed on the DPF List.
4. Publication on the DPF List constitutes the effective date of self-certification.

### Phase 5: Annual Re-Certification

1. Re-certification must be completed within 12 months of initial certification.
2. Update the privacy policy if any material changes have occurred.
3. Complete the re-certification form and pay the annual fee.
4. Failure to re-certify results in removal from the DPF List.
5. Even after removal, the organisation must continue to apply DPF protections to data received during the certification period.

## Contingency Planning Workflow

### Scenario: DPF Adequacy Decision Invalidated or Suspended

1. **Immediate action (Day 0-7)**: Activate backup SCCs for all US transfers currently relying solely on DPF.
2. **Assessment (Day 0-14)**: Determine whether existing SCC packages include completed Clause 14 TIAs for US transfers.
3. **Communication (Day 7-14)**: Notify all US data importers of the mechanism switch; request confirmation of SCC compliance.
4. **Documentation (Day 14-30)**: Update the transfer register to reflect SCCs as the primary mechanism; archive DPF records.
5. **Monitoring**: Track EC and EDPB guidance on transition timelines and any grace periods.

### Scenario: US Importer Loses DPF Certification

1. **Verification**: Confirm the loss of certification on dataprivacyframework.gov.
2. **Immediate assessment**: Determine whether the loss is due to non-renewal (administrative) or enforcement action (substantive concern).
3. **Transfer suspension**: If substantive concern, suspend new transfers pending resolution.
4. **Alternative mechanism**: If the relationship must continue, execute SCCs with a Clause 14 TIA.
5. **Data subject notification**: If the loss of certification materially affects data protection, consider whether GDPR Art. 34 notification obligations are triggered.