Podcast: Play in new window | Download (Duration: 19:28 — 26.9MB) | Embed
How well do you know the EU-U.S. Data Privacy Framework (DPF)? In this episode, privacy leaders put common assumptions to the test, answering each question with “myth or reality?” before explaining what organizations need to know about the DPF and international data transfers.
Is the DPF a substitute for GDPR? Does certification eliminate the need for Standard Contractual Clauses? Is the framework only useful for large companies? Myth or reality? The discussion separates fact from misconception while exploring DPF self-certification through the Department of Commerce, annual recertification, independent recourse mechanisms, privacy policy requirements, and the role of BBB National Programs.
The episode also tackles myths surrounding controllers, processors and subprocessors, data subject rights, onward transfers, vendor contracts, and security safeguards. Finally, the experts examine independent verification and how a DPF Verified seal can help organizations demonstrate that their published privacy commitments align with their actual policies and procedures.
Chapters:
00:00 – Welcome and DPF myth-versus-reality overview – Introduces the DPF and common questions about validity, certification, GDPR, and international data transfers.
01:16 – Is the DPF still valid after Trump v. Slaughter?- Explains why the episode says immediate obligations remain unchanged and reviews the framework’s Safe Harbor and Privacy Shield history.
04:52 – Is the DPF only for large multinational companies?- Shows how organizations of different sizes and sectors use the DPF, including small and medium-sized businesses.
07:53 – What the DPF is and how certification works – Defines the DPF and covers Department of Commerce self-certification, annual renewal, and independent recourse.
10:50 – BBB National Programs beyond dispute resolution – Covers privacy policy review, certification guidance, and recertification support beyond complaint handling.
11:38 – DPF vs. GDPR – Explains why the DPF covers international transfers but does not replace other GDPR obligations.
14:45 – DPF vs. Standard Contractual Clauses – Compares the DPF with SCCs and discusses scalability, efficiency, and clear certification requirements.
18:18 – DPF requirements for controllers and processors – Explores controller and processor responsibilities, notice, choice, and data subject rights.
22:33 – Onward transfers, vendors, and subprocessors – Reviews contracts, security safeguards, vendor due diligence, and subprocessor responsibilities.
27:06 – Independent verification and outside compliance review – Explains independent verification, outside compliance review, and the DPF Verified seal.
32:20 – Final takeaways and future-ready privacy programs – Closes with privacy accountability frameworks and preparing for a changing global privacy landscape.