Notice2026-10853
Agency Information Collection Activities; Submission to the Office of Management and Budget (OMB) for Review and Approval; Comment Request; Self-Certifications Under the Data Privacy Framework Program
Primary source
Metadata and text below are from the Federal Register, a public-domain U.S. government work. Always verify the official published version before relying on it for any legal matter.
Published
June 1, 2026
Issuing agencies
Commerce DepartmentInternational Trade Administration
Full Text
<html>
<head>
<title>Federal Register, Volume 91 Issue 104 (Monday, June 1, 2026)</title>
</head>
<body><pre>
[Federal Register Volume 91, Number 104 (Monday, June 1, 2026)]
[Notices]
[Pages 32375-32376]
From the Federal Register Online via the Government Publishing Office [<a href="http://www.gpo.gov">www.gpo.gov</a>]
[FR Doc No: 2026-10853]
-----------------------------------------------------------------------
DEPARTMENT OF COMMERCE
International Trade Administration
Agency Information Collection Activities; Submission to the
Office of Management and Budget (OMB) for Review and Approval; Comment
Request; Self-Certifications Under the Data Privacy Framework Program
The Department of Commerce will submit the following information
collection request to the Office of Management and Budget (OMB) for
review and clearance in accordance with the Paperwork Reduction Act of
1995, on or after the date of publication of this notice. We invite the
general public and other Federal agencies to comment on proposed and
continuing information collections, which helps us assess the impact of
our information collection requirements and minimize the public's
reporting burden. Public comments were previously requested via the
Federal Register on February 23, 2026 during a 60-day comment period.
This notice allows for an additional 30 days for public comments.
Agency: International Trade Administration, Department of Commerce.
Title: Self-Certifications under the Data Privacy Framework
Program.
OMB Control Number: 0625-0280.
Form Number(s): None.
Type of Request: Regular submission, extension of a current
information collection.
Number of Respondents: 4,575.
Average Hours per Response: 40 minutes.
Burden Hours: 2,977 hours.
Needs and Uses: The United States, the European Union (EU), the
United Kingdom (UK), and Switzerland share a commitment to enhancing
privacy protection, the rule of law, and a recognition of the
importance of transatlantic data flows to our respective citizens,
economies, and societies, but take different approaches to doing so.
Given those differences, the Department of Commerce (DOC) developed the
EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the
EU-U.S. Data Privacy Framework (UK Extension to the EU-U.S. DPF), and
the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) in consultation
with the European Commission, the UK Government, the Swiss Federal
Administration, industry, and other stakeholders. These arrangements
were respectively developed to provide U.S. organizations reliable
mechanisms for personal data transfers to the United States from the
European Union/European Economic Area, the United Kingdom (and, as
applicable, Gibraltar), and Switzerland while ensuring data protection
that is consistent with EU, UK, and Swiss law.
The DOC issued the EU-U.S. DPF Principles and the Swiss-U.S. DPF
Principles, including the respective sets of Supplemental Principles
(collectively the Principles) and Annex I of the Principles, as well as
the UK Extension to the EU-U.S. DPF under its statutory authority to
foster, promote, and develop international commerce (15 U.S.C. 1512).
The International Trade Administration (ITA) administers and supervises
the Data Privacy Framework program, including by maintaining and making
publicly available the Data Privacy Framework List, an authoritative
list of U.S. organizations that have self-certified to the DOC and
declared their commitment to adhere to the Principles pursuant to the
EU-U.S. DPF and, as applicable, the UK Extension to the EU-U.S. DPF,
and/or the Swiss-U.S. DPF. On the basis of the Principles, Executive
Order 14086, 28 CFR part 201, and accompanying letters and materials,
including ITA's commitments regarding the administration and
supervision of the Data Privacy Framework program, the European
Commission, the UK Government, and the Swiss Federal Administration
have respectively recognized the adequacy of the protection provided by
the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-
U.S. DPF thereby enabling personal data transfers from each respective
jurisdiction to U.S. organizations participating in the relevant part
of the Data Privacy Framework program.
In order to participate in the EU-U.S. DPF and, as applicable, the
UK Extension to the EU-U.S. DPF, and/or the Swiss-U.S. DPF an
organization must (a) be subject to the investigatory and enforcement
powers of the Federal Trade Commission (FTC), the Department of
Transportation (DOT), or another statutory body that will effectively
ensure compliance with the Principles; (b) publicly declare its
commitment to comply with the Principles; (c) publicly disclose its
privacy policies in line with the Principles; and (d) fully implement
them.
To rely on the EU-U.S. DPF and, as applicable, the UK Extension to
the EU-U.S. DPF, and/or the Swiss-U.S. DPF an organization must self-
certify its adherence to the Principles to the DOC, and both be placed
and remain on the Data Privacy Framework List. Such organizations'
commitment to comply with the Principles must be reflected in
[[Page 32376]]
their self-certification submissions to the DOC and in their privacy
policies. Organizations that only wish to self-certify their compliance
pursuant to the EU-U.S. DPF and/or the Swiss-U.S. DPF may do so;
however, organizations that wish to participate in the UK Extension to
the EU-U.S. DPF must participate in the EU-U.S. DPF. The DOC will
update the Data Privacy Framework List on the basis of annual re-
certification submissions made by participating organizations and by
removing organizations when they voluntarily withdraw, fail to complete
the annual re-certification in accordance with the DOC's procedures, or
are found to persistently fail to comply. The DOC will also maintain
and make available to the public an authoritative record of U.S.
organizations that have been removed from the Data Privacy Framework
List and will identify the reason each organization was removed. The
aforementioned authoritative list and record will remain available to
the public on the DOC's Data Privacy Framework program website. An
organization's failure to comply with the Principles after its self-
certification is enforceable by the FTC under Section 5 of the Federal
Trade Commission (FTC) Act prohibiting unfair or deceptive acts in or
affecting commerce (15 U.S.C. 45); by the DOT under 49 U.S.C. 41712
prohibiting a carrier or ticket agent from engaging in an unfair or
deceptive practice in air transportation or the sale of air
transportation; or under other laws or regulations prohibiting such
acts.
To initially self-certify or subsequently re-certify for the EU-
U.S. DPF and, as applicable, UK Extension to the EU-U.S. DPF, and/or
the Swiss-U.S. DPF, an organization must on each occasion provide to
the DOC a submission that contains the relevant information specified
in the Principles. The submission must be made via the DOC's Data
Privacy Framework program website by an individual within the
organization who is authorized to make representations on behalf of the
organization and any of its covered U.S. entities regarding its
adherence to the Principles. Such an organization must respond promptly
to inquiries and other requests for information from the DOC relating
to the organization's adherence to the Principles.
ITA has committed to follow up with organizations that have been or
wish to be removed from the Data Privacy Framework List. ITA will
direct organizations that allow their self-certifications to lapse to
verify whether they intend to re-certify or instead intend to withdraw.
An organization that intends to re-certify will be required to further
verify to the DOC that during the lapse of its certification status it
applied the Principles to relevant personal data received in reliance
on its participation in the Data Privacy Framework program and clarify
what steps it will take to address the outstanding issues that have
delayed its re-certification. An organization that intends to withdraw
will be required to further verify to the DOC what it will do and/or
has done (as applicable) with the relevant personal data that it
received in reliance on its participation in the Data Privacy Framework
program and who within the organization will serve as an ongoing point
of contact for Principles-related questions. Organizations will be
required to provide such verification to the DOC by completing and
submitting appropriate questionnaires to the DOC.
ITA has also committed to conduct compliance reviews on an ongoing
basis, including, as appropriate, through sending detailed
questionnaires to participating organizations. The DOC will require
that a participating organization complete and submit to the DOC such a
questionnaire when: (a) the DOC has received any specific, non-
frivolous complaints about the organization's compliance with the
Principles; (b) the organization does not respond satisfactorily to
inquiries by the DOC for information relating to the organization's
adherence to the Principles; or (c) there is credible evidence that the
organization does not comply with its commitments under the EU-U.S. DPF
and, as applicable, the UK Extension to the EU-U.S. DPF, and/or the
Swiss-U.S. DPF.
Affected Public: Primarily businesses or other for-profit
organizations.
Frequency: Annual and periodic.
Respondent's Obligation: Voluntary.
Legal Authority: The DOC's statutory authority to foster, promote,
and develop the foreign and domestic commerce of the United States (15
U.S.C. 1512).
This information collection request may be viewed at
<a href="http://www.reginfo.gov">www.reginfo.gov</a>. Follow the instructions to view the Department of
Commerce collections currently under review by OMB.
Written comments and recommendations for the proposed information
collection should be submitted within 30 days of the publication of
this notice on the following website <a href="http://www.reginfo.gov/public/do/PRAMain">www.reginfo.gov/public/do/PRAMain</a>.
Find this particular information collection by selecting ``Currently
under 30-day Review--Open for Public Comments'' or by using the search
function and entering the title of the collection.
Sheleen Dumas,
Departmental PRA Compliance Officer, Office of the Under Secretary for
Economic Affairs, Commerce Department.
[FR Doc. 2026-10853 Filed 5-29-26; 8:45 am]
BILLING CODE 3510-DR-P
</pre></body>
</html>Indexed from Federal Register on June 1, 2026.
This is legal information, not legal advice. Laws vary by jurisdiction and change frequently. Always verify current law with official sources and consult a licensed attorney in your jurisdiction for advice on your specific situation.