The EDPB has produced a note answering some questions about how the new Data Privacy Framework works. This can be found here. A couple of key points of immediate interest are as follows:
- Data can be transferred under the Adequacy Decision to organisations which are on the Data Privacy Framework list, which can be found here. There are almost 2500 members already.
- When transferring to companies not on the list, the EDPB states that “all the safeguards that have been put in place by the US Government in the area of national security (including the redress mechanism) apply to all data transferred to the US, regardless of the transfer tool used. Therefore, when assessing the effectiveness of the Article 46 GDPR transfer tool chosen, data exporters should take into account the assessment conducted by the Commission in the Adequacy Decision.”
