Helpful Hints on Self-Certifying Compliance with the U.S.-EU Safe Harbor Framework

Prior to submitting your organization's self-certification to the Department of Commerce, we recommend that you follow these helpful hints. These should be read in conjunction with the complete set of U.S.-EU Safe Harbor Framework Documents and the Safe Harbor Workbook . Following these helpful hints will help to ensure that your organization is meeting the requirements for self-certification, as set forth in FAQ 6.

Confirm that Your Organization is Subject to the Jurisdiction of the U.S. Federal Trade Commission or the U.S. Department of Transportation: Any U.S. organization that is subject to the jurisdiction of the Federal Trade Commission (FTC) or U.S. air carriers and ticket agents subject to the jurisdiction of the Department of Transportation (DOT) may participate in the Safe Harbor. The FTC and DOT have both stated in letters to the European Commission (located with the Framework documents under Letters G and H) that they will take enforcement action against organizations that state that they are in compliance with the Framework, but then fail to live up to their statements. If you are uncertain as to whether your organization falls under the jurisdiction of either the FTC or DOT, then please be sure to contact those agencies for more information.

Develop a Safe Harbor Compliant Privacy Policy Statement: Remember to develop a Safe Harbor compliant privacy policy before submitting your organization’s self-certification to the Department of Commerce.

  • Make Sure that Your Privacy Policy Conforms to the U.S.-EU Safe Harbor Privacy Principles: In order for a privacy policy to be compliant with the Framework, the privacy policy must conform to the Safe Harbor Privacy Principles, as well as any relevant points covered in the Frequently Asked Questions (FAQs), which are located with the other Framework documents. In addition, the privacy policy should reflect your organization’s actual and anticipated information handling practices. It is also important to write a policy that is clear, concise, and easy to understand.
  • Make Specific Reference in the Text of Your Privacy Policy to Your Organization's Safe Harbor Compliance: FAQ 6 requires each organization that self-certifies to state in its applicable published privacy policy that it complies with the U.S.-EU Safe Harbor Framework and that it has certified its adherence to the Safe Harbor Privacy Principles. In addition, each organization should include either a hyperlink to the Safe Harbor website or the corresponding URL (e.g.
  • Provide an Accurate Privacy Policy Location and Make Sure that Your Privacy Policy is Publicly* Available: At the time of self-certification, each organization must provide an accurate location for its applicable privacy policy. In addition, each organization should verify that its privacy policy is effective prior to self-certification. If your organization decides to post your privacy policy on an Internet or Intranet site, it must provide an accurate URL. If your organization: 1) has a public website on which it has posted a general privacy policy statement or made any other representation regarding its privacy practices; and 2) has chosen to cover personal data (e.g., client or customer data) other than your organization’s own human resources data under its self-certification, then the posted privacy-related language must include an affirmative statement that your organization complies with the U.S.-EU Safe Harbor Framework and has certified its adherence to the Safe Harbor Privacy Principles (i.e., it is not sufficient to simply upload a privacy policy to your organization’s Safe Harbor submission). In addition, the posted privacy-related language must also include either a hyperlink to the Safe Harbor website or the corresponding URL (e.g., If the information covered by your organization’s self-certification exclusively relates to your own organization’s human resources data, then the privacy policy covering such data need only be made available to your organization’s employees and as part of the Safe Harbor review process (i.e., your organization is not required to upload a copy to your organization’s Safe Harbor submission, but it is encouraged do so). If such a policy is listed as being located at corporate headquarters or on the corporate Intranet or is otherwise inaccessible to the general public via your organization’s public website, then your organization must provide the Department of Commerce with a copy of the policy so that it can be reviewed. If a copy of such a policy is provided for the reason just described, your organization must clarify whether or not it would object to having the copy uploaded to your organization’s Safe Harbor submission.

Establish Your Organization's Independent Recourse Mechanism: Under the Framework’s Enforcement Principle, self-certifying organizations must establish an independent recourse mechanism available to investigate unresolved complaints. (See FAQ 11 for more information regarding dispute resolution under Safe Harbor). Each organization must ensure that its recourse mechanism is in place prior to self-certification. In addition, each organization should include in its privacy policy an appropriate reference to the independent recourse mechanism(s), as well as relevant contact information for said mechanism(s).

  • In most cases, organizations self-certifying under Safe Harbor may choose to utilize private sector dispute resolution programs. Organizations like the Council of Better Business Bureaus (BBB), TRUSTe, the American Arbitration Association (AAA), JAMS, and the Direct Marketing Association (DMA) have developed programs that assist in compliance with the Framework's Enforcement Principle and FAQ 11.
  • Alternatively, organizations may choose to cooperate and comply with the EU data protection authorities (DPAs) with respect to all types of data. In doing so, an organization must follow the procedures outlined in FAQ 5.
  • If organization human resources data (i.e. personal information about your organization's own employees, past or present, collected in the context of the employment relationship) is being covered in your organization's self-certification, then your organization must agree to cooperate and comply with the EU DPAs with respect to such data. Additional guidance on the handling of human resources data under the Framework is provided in FAQ 9.
  • Organizations that either choose to or must utilize the EU DPAs are required to pay an annual fee of US $50 in order to cover the operating costs of the EU DPAs' panel. This fee is payable to the United States Council for International Business (U.S. Council for International Business c/o Safe Harbor – EU DPAs; 1212 Avenue of the Americas, 21st Floor; New York, NY 10036), which has agreed to act as trusted third party for this purpose. If you require further information on how to carry out the payment, please see:
  • If your organization requires further information on how the cooperation / compliance with the EU DPAs works, your organization may refer to the resources concerning the EU DPA panel (e.g., the Standard Complaint Form and Internal Operating Procedures) that are available on the European Commission’s website, contact the panel secretariat at:, and/or contact the DPAs directly (see

Ensure that Your Organization's Verification Mechanism is in Place: As discussed in FAQ 7, organizations self-certifying to the Framework are required to have procedures in place for verifying compliance. To meet this requirement, an organization may use either a self-assessment or an outside/third-party assessment program. For additional guidance on the Framework's verification requirement, please see FAQ 7.

Designate a Contact within Your Organization Regarding Safe Harbor: Each organization is required to provide a contact for the handling of questions, complaints, access requests, and any other issues arising under the Safe Harbor. This contact can be either the corporate officer that is certifying your organization's compliance with the Framework, or another official within your organization, such as a Chief Privacy Officer.

We hope that these hints prove helpful as your organization works to achieve compliance with the Framework. Further questions regarding the Safe Harbor self-certification process or compliance with the EU data protection requirements may be directed to the International Trade Administration (ITA)’s Safe Harbor Team.

  • Questions should be directed, whenever possible, via e-mail to, so that any member of the Safe Harbor Team could respond (i.e., due to the volume of phone calls received by the Safe Harbor Team, it is often more expedient to correspond via e-mail).
  • Phone calls concerning either Safe Harbor Framework should be directed to:

David Ritchie
Tel.: (202) 482-4936

Michael Rose
Tel.: (202) 482-0142

Blake Murray
Tel.: (202) 482-6435

Mailing Address:

U.S. Department of Commerce
U.S.-EU & U.S.-Swiss Safe Harbor Programs
1401 Constitution Avenue, N.W.
Room 20001
Washington, D. C. 20230