EU PSD2 — Payment Services Directive (Directive (EU) 2015/2366)

Why it Matters

The EU-US Data Privacy Framework enables organizations to lawfully transfer personal data while addressing complex regulatory and privacy requirements.

Key benefits include:

• Support cross-border data transfers

Facilitate compliant movement of personal data between the EU and US while reducing operational barriers.

• Enhance regulatory alignment

Demonstrate adherence to GDPR and European data protection standards, improving trust with regulators and customers.

• Strengthen data protection practices

Institute procedures and controls for protecting EU-origin personal data within US-based organizations.

• Increase audit readiness

Maintain documentation and safeguards required for external reviews, investigations, or compliance audits.

• Promote accountability and transparency

Require clear privacy policies and defined dispute resolution mechanisms, fostering responsible data management across the organization.

How it Works

The EU-US Data Privacy Framework (DPF) is structured around a set of privacy principles derived from the EU’s General Data Protection regulation (GDPR) and aligned with U.S. regulatory requirements. These core principles—notice, choice, accountability for onward transfer, security, data integrity, access, and recourse—serve as the foundation for data protection obligations and cross-border data transfers. The framework provides a lifecycle approach to personal data management, with specific requirements for security safeguards and governance processes to ensure compliance throughout an organization’s operations.

In practice, organizations implementing the DPF self-certify their commitment to the framework’s principles and maintain active oversight to ensure ongoing adherence. Typical activities include establishing governance programs around privacy, performing risk assessments for data transfers, deploying technical and organizational security controls, and managing processes for data subject access and redress. Organizations also conduct regular reviews and compliance assessments to verify that data handling practices align with DPF requirements and support regulatory compliance across global operations.

Using SmartSuite, organizations operationalize the EU-US Data Privacy Framework by using capabilities such as centralized control libraries for DPF principles, risk registers for privacy risk management, and policy governance modules. The platform supports evidence collection for compliance, facilitates monitoring, and provides dashboards for tracking data protection activities. Audit readiness, remediation workflows, and reporting enable organizations to meet documentation, monitoring, and regulatory compliance obligations efficiently.

Key Elements

• Privacy Principle Categories

Organizes requirements into core domains including notice, choice, accountability, security, integrity, access, and recourse.

• Self-Certification Mechanism

Specifies an annual process for organizations to attest public compliance with framework principles.

• Independent Recourse Processes

Establishes structured avenues for individuals to seek resolution of data privacy complaints.

• Onward Transfer Accountability

Describes necessary controls for managing data sharing with third parties under the framework.

• Security and Safeguards Domain

Defines expectations for protecting personal data using appropriate technical and organizational measures.

• Oversight and Enforcement Structure

Outlines government and independent oversight methods used to ensure compliance and address violations.

Framework Scope

The EU-US Data Privacy Framework (DPF) applies to entities transferring personal data from the EU to the US, including service providers, multinational organizations, and compliance teams. Governing personal data processing systems and cross-border transfers, the DPF is typically implemented when meeting regulatory obligations, managing privacy risks, or supporting certification and international data protection programs.

Framework Objectives

The EU-US Data Privacy Framework (DPF) aims to enable secure and compliant transatlantic data transfers while upholding strong data protection standards.

Safeguard personal data in cross-border transfers between the EU and US

Strengthen privacy governance and accountability for participating organizations

Support compliance with EU data protection laws and regulatory expectations

Enhance security controls to reduce cybersecurity and privacy-related risks

Promote effective risk management in international data processing operations

Improve operational resilience and audit readiness through documented privacy practices The EU‑US Data Privacy Framework (DPF) complements mechanisms such as EU Standard Contractual Clauses, Binding Corporate Rules and the Swiss‑U.S. Data Privacy Framework by enabling lawful transatlantic personal data transfers under U.S. safeguards. Organizations implement DPF for regulatory compliance, certification/self‑certification, contractual transfer needs, and to demonstrate governance and operational privacy controls.

Framework in Context

The EU‑US Data Privacy Framework (DPF) complements mechanisms such as EU Standard Contractual Clauses, Binding Corporate Rules and the Swiss‑U.S. Data Privacy Framework by enabling lawful transatlantic personal data transfers under U.S. safeguards. Organizations implement DPF for regulatory compliance, certification/self‑certification, contractual transfer needs, and to demonstrate governance and operational privacy controls.

Common Framework Mappings

Organizations map the EU‑US Data Privacy Framework to other data protection and transfer mechanisms to ensure consistent cross‑border compliance, simplify controls, and meet diverse regulatory and contractual obligations.

Mapped frameworks include:

APEC Cross-Border Privacy Rules (CBPR) System

Binding Corporate Rules (BCRs)

California Consumer Privacy Act (CCPA) / California Privacy Rights Act (CPRA)

EU Standard Contractual Clauses (SCCs)

General Data Protection Regulation (GDPR)

ISO/IEC 27701

Swiss‑U.S. Data Privacy Framework

UK International Data Transfer Agreement (IDTA)

‍