--- title: "EU-US Privacy Shield Now in Effect: Compliance Guide" description: The EU-US Privacy Shield is now in effect, allowing the transfer of personal data/PII from users in Europe to companies in the United States. image: https://spzlegal.com/hubfs/39-1.png --- [Skip To Content](https://spzlegal.com/blog/data-privacy/eu-us-privacy-shield-now-effect#main-content) [![spz-legal-logo-2024](https://spzlegal.com/hubfs/logos/spz-legal-logo-2024.svg)](https://spzlegal.com/) - [Clients](https://spzlegal.com/our-clients) - [Featured Clients](https://spzlegal.com/our-clients) - [Case Study: Verto Education](https://spzlegal.com/verto-case-study) - [Case Study: Kong Studios](https://spzlegal.com/kong-studios-case-study) - [Case Study: WindBorne](https://spzlegal.com/windborne-case-study) - [Case Study: Tango](https://spzlegal.com/tango-case-study) - [Case Study: Sown To Grow](https://spzlegal.com/sown-to-grow-case-study) - [Case Study: Capture6](https://spzlegal.com/capture6-case-study) - [Case Study: Datava](https://spzlegal.com/datava-case-study) - [Case Study: Voxel](https://spzlegal.com/from-scrappy-startup-to-selling-to-fortune-100) - [Team](https://spzlegal.com/team) - [About Us](https://spzlegal.com/team) - [Becky Mancero](https://spzlegal.com/team/becky-mancero) - [David De La Flor](https://spzlegal.com/team/david-de-la-flor) - [Elizabeth Thorne](https://spzlegal.com/team/elizabeth-thorne) - [Gea Kang](https://spzlegal.com/team/gea-kang) - [Hannah Porter](https://spzlegal.com/team/hannah-porter) - [Hash Zahed](https://spzlegal.com/team/hash-zahed) - [Jessica Sulahian](https://spzlegal.com/team/jessica-sulahian) - [Morgan Kasenchak](https://spzlegal.com/team/morgan-kasenchak) - [Paige Southworth](https://spzlegal.com/paige-southworth) - [Ryan Shaening Pokrasso](https://spzlegal.com/team/ryan-shaening-pokrasso) - [Sam Taylor](https://spzlegal.com/team/sam-taylor) - [Tami Gore](https://spzlegal.com/team/tami-gore) - [Specialists](https://spzlegal.com/our-partners) - [Services](https://spzlegal.com/business-law-services) - [Formation & Corporate](https://spzlegal.com/business-law-services/formation) - [Mergers & Acquisitions](https://spzlegal.com/business-law-services/mergers-acquisitions) - [Funding](https://spzlegal.com/business-law-services/funding) - [Hiring & Equity Compensation](https://spzlegal.com/business-law-services/employment) - [Data Privacy](https://spzlegal.com/business-law-services/data-privacy) - [IP Protection](https://spzlegal.com/business-law-services/ip-protection) - [Commercial Agreements](https://spzlegal.com/business-law-services/sales-agreements) - [Startup Center](https://spzlegal.com/startup-center) - [Formation & Corporate](https://spzlegal.com/startup-center/formation-and-corporate-topics) - [Mergers & Acquisitions](https://spzlegal.com/startup-center/mergers-and-acquisitions) - [Funding](https://spzlegal.com/startup-center/funding) - [Hiring & Equity Compensation](https://spzlegal.com/startup-center/hiring) - [IP Protection](https://spzlegal.com/startup-center/ip-protection) - [Data Privacy](https://spzlegal.com/startup-center/data-privacy) - [Commercial Agreements](https://spzlegal.com/startup-center/commercial-agreements) - [Blog](https://spzlegal.com/blog) - [Contact](https://spzlegal.com/contact) - [LinkedIn](https://www.linkedin.com/company/spz-legal) # EU-US Privacy Shield Now in Effect [Data Privacy](https://spzlegal.com/blog/tag/data-privacy) ![](https://spzlegal.com/hs-fs/hubfs/39-1.png?width=760&height=428&name=39-1.png) On July 12, the European Commission formally adopted the EU-US Privacy Shield, a bilateral data privacy agreement hastily assembled from [the wreckage of the Safe Harbor Framework](https://spzlegal.com/blog/data-privacy/ecj-strikes-down-us-eu-safe-harbor),[which was](https://spzlegal.com/blog/data-privacy/ecj-strikes-down-us-eu-safe-harbor)invalidated by the European Court of Justice in 2015. U.S. companies immediately lined up to apply the new framework, with tech giants like [Google](https://venturebeat.com/2016/08/29/google-signs-up-for-the-e-u-u-s-privacy-shield-framework/), [Salesforce](https://www.privacyshield.gov/participant?id=a2zt0000000KzLyAAK) and [Microsoft](https://privacy.microsoft.com/en-us/microsoft-eu-us-privacy-shield) broadcasting their willingness to abide by the deal’s strictures. As of August 26th, [over two hundred companies had adopted Privacy Shield](https://www.computerworld.com/article/3112576/internet/privacy-shield-data-transfer-agreement-now-covers-200-companies.html), and [the list is growing.](https://www.privacyshield.gov/list) ## Why do we need Privacy Shield? The European Union prohibits transfers of personal data from Europe to countries without “adequate” data privacy protection, as defined by the EU itself. Given the [longstanding legal differences](https://www.linkedin.com/pulse/20121023040724-2259773-on-privacy-why-is-the-eu-so-different-from-the-us) in approaches to privacy between the EU and the U.S., companies dealing in cross-border data flows need a mechanism to self-certify their compliance with EU law. After the demise of the Safe Harbor Framework, the legal situation surrounding data transfers to the U.S. was thrown into limbo. Privacy Shield aims to fix that. ## What Is Privacy Shield? Privacy Shield is a bilateral data protection agreement between the EU and the U.S., allowing American companies to self-certify their compliance with EU data protection regulations and transfer personal data out of the EU. Privacy Shield is built on seven foundational principles, set forth below: - **Notice**: Companies must inform consumers of certain data-related rights and practices under Privacy Shield, including the purposes of third-party disclosures, consumer data access rights and company liability for onward transfers. - **Choice**: Privacy Shield prohibits businesses from using data in ways not authorized by their customers. Companies must allow clear routes for consumers to opt out of activities related to their personal data, such as disclosure to a third party. - **Accountability For Onward Transfer**: Companies are only allowed to transfer data to third-party agents “for limited and specified purposes,” and they must comply with the Notice and Choice Principles in order to do so. The third-party agent must provide “at least the same level of privacy protection as is required by the Principles.” - **Security**: Companies must take “reasonable and appropriate measures” to safeguard the privacy of personal data. - **Data Integrity And Purpose Limitation**: Personal data must be “limited to the information that is relevant for purposes of processing,” in accordance with the original use authorized by the consumer. - **Access**: Organizations. must give consumers access to their personal information, and allow them to make amendments and monitor its usage for possible violations. - **Recourse, Enforcement and Liability**: Companies must offer independent dispute resolution mechanisms free of charge to consumers alleging Privacy Shield violations. Companies that violate Privacy Shield strictures are subject to enforcement actions by the FTC or the Department of Transportation, and are also liable for third-party agent and service provider violations unless they can prove no responsibility. Companies must verify their compliance with Privacy Shield through internal self-assessments or independent third-party audits. ## How Do I Sign Up? The Commerce Department has published a [detailed how-to guide](https://www.privacyshield.gov/servlet/servlet.FileDownload?file=015t0000000QJzS) on the Privacy Shield self-certification processes. Here are the recommended steps: - **Ensure Eligibility**: U.S. companies must be subject to the jurisdiction of either the Federal Trade Commission or the Department of Transportation. Make sure your organization falls within their parameters. - **Adjust Privacy Practices**: If your organization seeks to self-certify under Privacy Shield you must first ensure that your privacy practices comply with the criteria described above. This is not always a straightforward process and you may find it helpful to work with a consultant for this critical step.   - **Develop A Compliant Privacy Policy**: You need to write a privacy policy that complies with all the Principles of Privacy Shield. The Policy should reflect your commitments to the Principles and explain how you meet the requirements of Privacy Shield. [We can help write an effective privacy policy](https://spzlegal.com/contact) - **Identify Your Independent Recourse Mechanism**: Under Privacy Shield, you need to maintain an independent system to investigate customer complaints at no cost to the complainant. The Commerce Department recommends using private dispute resolution programs offered by organizations like the [American Arbitration Association](https://adr.org/news-and-insights/explaining-the-new-data-privacy-framework-privacy-shield-s-replacement/) and the [Council of Better Business Bureaus](https://www.bbb.org/EU-privacy-shield/bbb-eu-safe-harbor-dispute-resolution/). - **Adopt A Verification Strategy**: Ensure you have an adequate verification program in place to monitor your compliance with Privacy Shield. You can conduct a self-assessment, but third-party audits pose less potential for creating conflicts of interest. - **Designate A Privacy Shield Contact**: Appoint an employee to handle all Privacy Shield-related queries, complaints and issues. [Get Help With Your Privacy](https://spzlegal.com/contact) --- *DISCLAIMER: The information in this article is provided for informational purposes only and should not be construed or relied upon as legal advice. This article may constitute attorney advertising under applicable state laws.* [![spz-legal-logo-2024](https://spzlegal.com/hubfs/logos/spz-legal-logo-2024.svg)](https://spzlegal.com/) Categories - [Funding](https://spzlegal.com/blog/tag/funding) - [Incorporation](https://spzlegal.com/blog/tag/incorporation) - [Employment](https://spzlegal.com/blog/tag/employment) - [Contracts](https://spzlegal.com/blog/tag/contracts) - [Data Privacy](https://spzlegal.com/blog/tag/data-privacy) - [M&A](https://spzlegal.com/blog/tag/ma) - [Firm Culture](https://spzlegal.com/blog/tag/firm-culture) - [News](https://spzlegal.com/blog/tag/news) - [Social Enterprise](https://spzlegal.com/blog/tag/social-enterprise) - [Acquired](https://spzlegal.com/blog/tag/acquired) - [Intellectual Property](https://spzlegal.com/blog/tag/intellectual-property) - [Client Engagement](https://spzlegal.com/blog/tag/client-engagement) - [Nonprofit](https://spzlegal.com/blog/tag/nonprofit) - [AI](https://spzlegal.com/blog/tag/ai) - [Artificial Intelligence](https://spzlegal.com/blog/tag/artificial-intelligence) Recent Posts - [Becky Mancero Recognized by Best Lawyers: Ones to Watch for Second Consecutive Year](https://spzlegal.com/blog/becky-mancero-best-lawyers-ones-to-watch-2026) - [What We Fix in Diligence Over and Over Again Before a Financing or Exit](https://spzlegal.com/blog/startup-legal-issues-before-financing-exit) - [Becky Mancero on the Melissa Widner Podcast: Cap Tables, Equity Mistakes, and AI in the Legal World](https://spzlegal.com/blog/becky-mancero-on-the-melissa-widner-podcast-cap-tables-equity-mistakes-ai-in-the-legal-world) - [Spinning Out a Product Into a New Startup: Legal Issues Founders Need to Solve Early](https://spzlegal.com/blog/spinning-out-product-new-startup-legal-guide) - [Converting an LLC to a Corporation: When It Makes Sense and How to Do It Without Creating a Mess](https://spzlegal.com/blog/converting-llc-to-corporation-startup-guide) - [The Role of LOIs in M&As: Structuring Letters of Intent](https://spzlegal.com/blog/the-role-of-lois-in-mas-structuring-letters-of-intent) - [Exit Structures: Mergers, Acquisitions, & Tax Treatment](https://spzlegal.com/blog/exit-structures-mergers-acquisitions-tax-treatment) - [Due Diligence Best Practices: Be Prepared for M&A Success](https://spzlegal.com/blog/due-diligence-best-practices-be-prepared-for-ma-success) Locations **San Francisco Bay Area, California** **Milwaukee, Wisconsin** **Los Angeles, California** **Denver, Colorado** **Miami, Florida** **Austin, Texas** Contact Us [Email](https://spzlegal.com/contact) Follow Us - [LinkedIn](https://www.linkedin.com/company/spz-legal) Startup Topics - [Formation](https://spzlegal.com/blog/tag/incorporation) - [Funding](https://spzlegal.com/blog/tag/funding) - [Employment](https://spzlegal.com/blog/tag/employment) - [Intellectual Property](https://spzlegal.com/blog/tag/intellectual-property) - [Data Privacy](https://spzlegal.com/blog/tag/data-privacy) - [Commercial Agreements](https://spzlegal.com/blog/tag/contracts) - [M&A Law](https://spzlegal.com/blog/tag/ma) © 2026 [SPZ Legal, P.C. Startup Lawyers](https://spzlegal.com/) - [Terms of Use](https://spzlegal.com/terms) - [Privacy Policy](https://spzlegal.com/privacy) [![California Chambers Spotlight 2025 Award](https://spzlegal.com/hs-fs/hubfs/ca-chamber-spotlight-2025-badge.jpg?width=300&height=300&name=ca-chamber-spotlight-2025-badge.jpg)](https://chambers.com/law-firm/spz-legal-p-c-120:23727975) DISCLAIMER: The information on this website is provided for informational purposes only and may not be updated over time. Nothing on this website should be construed as legal advice or relied upon in any way. No attorney-client relationship is intended to be created through this website. This website may be considered attorney advertising in some states. Prior results do not guarantee a similar outcome. ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Aaron Murphy", "url" : "https://spzlegal.com/blog/author/aaron" }, "dateModified" : "2026-07-09T13:25:29.179Z", "datePublished" : "2019-09-15T15:22:12.000Z", "headline" : "EU-US Privacy Shield Now in Effect: Compliance Guide", "image" : [ "https://spzlegal.com/hubfs/39-1.png" ], "mainEntityOfPage" : { "@id" : "https://spzlegal.com/blog/data-privacy/eu-us-privacy-shield-now-effect", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://spzlegal.com/hubfs/logos/spz-legal-logo-2024.svg" } } } ```