Self-Certifications under the Data Privacy Framework Program
Extension without change of a currently approved collection
No
Regular
06/01/2026
Requested
Previously Approved
36 Months From Approved
07/31/2026
4,575
4,775
2,977
3,062
232,234
217,091
The United States, the European Union (EU), the United Kingdom (UK), and Switzerland share a commitment to enhancing privacy protection, the rule of law, and a recognition of the importance of transatlantic data flows to our respective citizens, economies, and societies, but take different approaches to doing so. Given those differences, the DOC developed the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF in consultation with the European Commission, the UK Government, the Swiss Federal Administration, industry, and other stakeholders. These arrangements were respectively developed to provide U.S. organizations reliable mechanisms for personal data transfers to the United States from the European Union, the United Kingdom (and, as applicable, Gibraltar), and Switzerland while ensuring data protection that is consistent with EU, UK, and Swiss law.
The DOC issued the EU-U.S. DPF Principles and the Swiss-U.S. DPF Principles, including the respective sets of Supplemental Principles (collectively the Principles) and Annex I of the Principles, as well as the UK Extension to the EU-U.S. DPF under its statutory authority to foster, promote, and develop international commerce (15 U.S.C. § 1512). ITA administers and supervises the Data Privacy Framework program, including by maintaining and making publicly available the Data Privacy Framework List, an authoritative list of U.S. organizations that have self-certified to the DOC and declared their commitment to adhere to the Principles pursuant to the EU-U.S. DPF and, as applicable, the UK Extension to the EU-U.S. DPF, and/or the Swiss-U.S. DPF. Such organizations must respond promptly to inquiries and requests from ITA for information relating to their adherence to the Principles. On the basis of the Principles, Executive Order 14086, 28 CFR part 201, and accompanying letters and materials, including ITAâs commitments regarding the administration and supervision of the Data Privacy Framework program, the European Commission, the UK Government, and the Swiss Federal Administration have respectively recognized the adequacy of the protection provided by the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF , and the Swiss-U.S. DPF thereby enabling personal data transfers from each respective jurisdiction to U.S. organizations participating in the relevant part of the Data Privacy Framework program.
To initially self-certify or subsequently re-certify for the EU-U.S. DPF and, as applicable, UK Extension to the EU-U.S. DPF, and/or the Swiss-U.S. DPF, an organization must on each occasion provide to the DOC a submission that contains the relevant information specified in the Principles. The submission must be made via the DOC's Data Privacy Framework program website by an individual within the organization who is authorized to make representations on behalf of the organization and any of its covered U.S. entities regarding its adherence to the Principles. Such an organization must respond promptly to inquiries and other requests for information from the DOC.
The adjusted figures and by extension the estimates provided are projections that take into account (1) the number of âresponsesâ (i.e., the self-certification form-based initial self-certification and re-certification applications, and the four different types of questionnaires) that were received, reviewed, and processed in the preceding twelve-month period or calendar year, (2) the revisions to the applicable fee schedule that entered into effect on October 1, 2024, and amended the respective amounts of the applicable fees, and (3) increases in the respective, average hourly rates of the relevant types of individuals (i.e., lawyer and manager respondents with regard to Question 12, and DOC employees and contractors with regard to Question 14) performing the tasks directly associated with the âresponsesâ that were received, reviewed, and processed in the preceding twelve-month period or calendar year.
On behalf of this Federal agency, I certify that the collection of information encompassed by this request complies with 5 CFR 1320.9 and the related provisions of 5 CFR 1320.8(b)(3).
The following is a summary of the topics, regarding the proposed collection of information, that the certification covers:
(i) Why the information is being collected;
(ii) Use of information;
(iii) Burden estimate;
(iv) Nature of response (voluntary, required for a benefit, or mandatory);
(v) Nature and extent of confidentiality; and
(vi) Need to display currently valid OMB control number;
If you are unable to certify compliance with any of these provisions, identify the item by leaving the box unchecked and explain the reason in the Supporting Statement.
0625-0280 Supporting Statement_2026.docx
Data Privacy Framework (DPF) Program Self-Certification / Re-Certification Application Form