Rules of Procedure for the “Informal Panel of EU DPAs” according to the EU-U.S. Data Privacy Framework - version 2.0

Rules of Procedure for the “Informal Panel of EU DPAs” according to the EU - U.S. Data Privacy Framework Version 2 .0 Adopted on 15 January 2026 1 | Adopted Version history Version Date Adoption information version 1.0 17 April 2024 adoption of the Rules of Procedure version 2 . 0 15 January 2026 adoption of updated version 2 | Adopted 3 | Adopted 1 Glossary GDPR: Regulation 2016/679/EU of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC. EU - US Data Privacy Framework or DPF: self - certification mechanism for companies in the U.S. that includes principles, rules and obligations related to the processing of personal data of EEA individuals. The European Commission considers that transfers of personal data from the EEA to companies in the U.S. certified under the DPF enjoy an adequate level of protection. As a result, personal data can be transferred to U.S. certified companies, without the ne ed to put in place further safeguards or obtain an au thorisation. More information can be found in the EDPB FAQs 1 . DPF Adequacy Decision: Commission Implementing Decision EU 2023/1795 of 10 July 2023, pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council on the adequate level of protection of personal data under the EU - U.S. Data Privacy Framework 2 . DPF Principles: Annex I to the DPF Adequacy Decision, containing the EU - US Data Privacy Framework Principles, including the Supplemental Principles, to which companies in the U.S. should abide in order to be self - certified under the DPF. The DPF Principles are also available here 3 . DPF company: a n organisation 4 in the U.S. that holds an active self - certification under the DPF. The list of companies self - certified under the DPF can be consulted here 5 . DPA: Data Protection Authority within the European Economic Area. A list of DPAs and their contact details is available here 6 . FTC : t he U.S. Federal Trade Commission DoT : the U.S. Department of Transportation DoC : the U.S. Department of Commerce DPF complaint: complaint concerning the compliance of a DPF company with the DPF Principles, with respect to the processing of personal data of an individual that has been transferred from the EEA to that company under the DPF. 1 EU - US Data Privacy Framework FAQ for European individuals : https://www.edpb.europa.eu/our - work - tools/our - documents/other - guidance/eu - us - data - privacy - framework - faq - european - individuals - 0_en , EU - U.S. Data Privacy Framework F.A.Q. for European businesses - version 2.0: https://www.edpb.europa.eu/our - work - tools/our - documents/other - guidance/eu - us - data - privacy - framework - faq - european - businesses - 0_en 2 Available here: https://eur - lex.europa.eu/legal - content/EN/TXT/PDF/?uri=CELEX:32023D1795 3 https://www.dataprivacyframework.gov/program - articles/Participation - Requirements - Data - Privacy - Framework - (DPF) - Principles 4 In this context, “company” and “organisation” are used indistinctively. 5 https://www.dataprivacyframework.gov/list 6 https://www.edpb.europa.eu/about - edpb/about - edpb/members_en 4 | Adopted 2 Introduction The “Informal Panel of EU DPAs” ( hereinafter: “ the P anel”) is designed according to recital 75 of the DPF Adequacy Decision and the supplemental principle III.5 (Operation of DPA Panels) of the DPF Principles . The P anel is competent for providing binding advice to DPF companies, following unresolved DPF complaints from individuals about the handling of personal information that has been transferred from the European Union 7 (hereinafter: EU) under the DPF 8 . When a DPA receives a complaint regarding a DPF company 9 , the DPA should first verify whether said complaint qualifies as a DPF complaint. Once a DPA verifies that a complaint received qualifies as a DPF complaint and the Panel is competent to handle it, the present procedure will apply. As a general rule, the P anel will aim to provide advice within 60 days after the Panel received the DPF complaint . This deadline is indicative and not binding for the DPAs. However, advice will be issued by the P anel only after both sides in a dispute have had a reasonable opportunity to comment and to provide any evidence they wish. The advice has the aim to bring into compliance the processing activities of personal data transferred under the DPF. In cases of non - compliance with the advice given by the Panel , the Panel will refer such cases to the DoC (which may remove organisations from the EU - U.S. DPF list) or, for possible enforcement action, to the FTC or the DoT (failure to cooperate with the DPAs or to comply with the DPF Principles is actionable under U.S. law) 10 . These rules do not affect the enforcement powers and actions (if any) of the DPAs against the exporter under the GDPR and the rights of the data subjects in this respect. The following rules of procedure will give guidance on how the panel will operate. For all procedural rules that are not specified in the DPF Adequacy Decision and in these Rules of Procedure, the DPF complaint/referral will be handled according to the procedural rules of the Member State of the Lead DPA that will adopt the decision. 3 C ompetence of the P anel The DPA that received a DPF complaint or referral will assess if the P anel is competent to handle the DPF complaint or referral. The P anel is only competent to handle DPF complaints concerning HR Data 11 transferred from an EU entity to a DPF company or for complaints involving only non - HR data and where the 7 References to the EU should be understood as also including the three EEA countries not part of the EU. 8 Individuals may complain directly to the DPA or to the company. In the latter case, the company may refer the complaint to a DPA, when necessary. 9 DPAs may receive compla ints directly from individuals and by referral from the DPF company. 10 Rec. 73 DPF. 11 HR Data refers to human resources data collected in the context of an employment relationship . 5 | Adopted DPF company has voluntarily opted for dispute resolution by the Panel . The competence of the panel can be verified on the DPF website of the DoC 12 . If the P anel is not competent to handle the complaint from the data subject or the referral from the DPF company , the DPA that received the complaint/referral will assess its competence to handle the complaint under the GDPR . Where the P anel is competent, there is a need to designate the Lead DPA and co - reviewer DPAs. 4 Designation of Lead DPA and co - reviewer DPAs For the handling of each DPF complaint or referral, the P anel will be formed by one DPA acting as Lead DPA and other designated co - reviewer DPAs. The DPAs that will act as Lead and as co - reviewers should be identified in a timely manner and, in principle, within two weeks’ time after the complaint - receiving DPA has verified that the complaint qualifies as a DPF complaint and has informed the other SAs of it. 4.1 Designation of the Lead DPA Principle As a general rule, the Lead DPA for handling a DPF complaint within the P anel should be the national DPA that receives the DPF complaint by an individual. As a general rule, the Lead DPA for handling a referral by a certified US company should be the national DPA that is competent for the exporter 13 . If the same or very similar DPF complaints are lodged with several DPAs it will be presumed that the DPA that first received a DPF complaint will act as Lead DPA . Derogations In exceptional circumstances, another DPA can be designated as Lead . This may arise when the DPF complaint concerns a data transfer that relates to a cross - border processing as set out in Art. 4 (23) GDPR. In such situation, the Lead DPA under Article 56 GDPR (i.e. the supervisory authority of the main establishment or of the single establishment of the data exporter) shall decide whether or not it will act as Lead DPA also for handling the DPF complaint in the P anel. In that case, the complaint - receiving SA should also be part of the Panel as a co - reviewer SA and will act as interlocutor with the complainant. 12 One can do this by typing the organis ation’s name into the search bar within the Data Privacy Framework List available at https://www.dataprivacyframework.gov/ , and then by clicking on the organis ation’s name, and then on “Questions or DPF complaints?”; where the panel is competent, it is referred to as “EU Da ta Protection Authorities (DPAs) ” . 13 As defined in the EDPB’s Guidelines 05/2021 on the Interplay between the application of Article 3 and the provisions on international transfers as per Chapter V of the GDPR. 6 | Adopted 4.2 Designation of the co - reviewer DPAs As a general rule, there should be two co - reviewers. In appropriate circumstances , e.g. depending on the number of concerned individuals , the number of MS involved in the same kind of transfers, the P anel can be extended if more than two DPAs are interested in participating in the P anel and can put forward a specific interest. Where the DPA of the main establishment or of the single establishment of the data exporter in the sense of Article 56 decides to act as Lead DPA for the Panel , the co - reviewers should be concerned DPAs in the sense of Article 4(22) GDPR . The complaint - receiving DPA should be a co - reviewer in this case. In cases where fewer than two DPA indicate an interest in acting as co - reviewer, the Lead DPA has the prerogative to designate up to two co - r eviewers. When selecting the co - reviewers , the Lead DPA should in particular take into consideration DPAs in whose jurisdiction the EU headquarter or significant subsidiaries of the DPF company are s ituated, if any. Other criteria that can be considered include the place where the relevant data processing is facilitated in the EU, the place in the EU from which most data transfers take place, the place where a large number of EU individuals are likely to be affected by the alleged violation, particular expertise located with a certain DPA and available resources. The DPAs shall respond to the enquiry to act as co - reviewers from the Lead DPA within one week since receiving the request . 5 Duties of DPA that receives a DPF complaint/referral The DPA that receives a complaint from an individual or a referral from a DPF company shall: • First, assess whether the complaint qualifies as a DPF complaint 14 ; • If the DPA concludes that the complaint qualifies as a DPF complaint, it shall then assess whether the P anel is competent ( namely, when the complaint relates to HR Data or the DPF company opted for dispute resolution by the Panel ) ; • I f the DPA concludes that the complaint does not qualify as a DPF complaint or that it qualifies as such but the Panel is not competent , the DPA shall forward the complaint to the competent body if applicable, a n d inform t h e complainant/referring company ; • I f appropriate, encourage and if necessary, help complainants in the first instance to use the DPF complaint handling arrangements provided by the relevant DPF compan y; 14 For example, the DPA can check whether the personal data was transferred from the EEA to a DPF company, whether the transfer took place on the basis of the DPF and whether the complaint refers to said data and the compliance of the DPF company with the DPF, with respect to the processing of the data transferred . 7 | Adopted • I nform all EDPB - members about the DPF complaint , once the DPA verifies that it qualifies as a DPF complaint; • T ake all necessary steps for the appointment of the Lead - DPA and the co - reviewers , in accordance with Section 4 above; • P rovide any translation needed (mostly into and from English or other languages , where appropriate) emerging from the communication with the complainant and the DoC, th e FTC or any other US statutory body through the P anel, regardless of whether the DPA is acting as Lead or not. 6 Duties of the Lead DPA The Lead DPA shall : • act as single point of contact towards the US - company concerned throughout the entire panel procedure and facilitate communication between and with the panel • identify or designate co - reviewers in consultation with the DPAs ; • inform all EDPB members about the participating DPAs in the P anel ; • inform the DPF company in writing of the substance of the DPF complaint and any other relevant information . P ersonal data of the complainant should only be transferred if it is necessa ry to resolve the DPF complaint; • before any transfer of personal data, inform the data subject and provide them with the opport unity to oppose to the transfer; • offer all sides (complainant, DPF company) a reasonable opportunity to comment and to provide any evidence they wish on the matter , within a reasonable time - limit ; • draft the proposed advice , including remedies (where appropriate) and circulate it among the co - reviewers for comments; • take the comments from co - reviewers into consideration and finalise the draft on that basis. If necessary, the Lead DPA will organise discussions with the co - reviewers and endeavour to reach a consensus • issue t he consolidated advice to the DPF company ; • inform the other DPAs of the advice issued . The information provided to the DPAs should not include the personal data of the individual and should respect any obligations of commercial confidentiality ; 8 | Adopted • make public on its website the outcome of the DPF complaint, if appropriate 15 . The publication should not include personal data of the complainant and should respect commercial confidentiality duties ; • in case of non - compliance by a DPF company with the advice issued by the P anel, the Lead DPA shall prepare a draft on how to proceed and coordinate a decision in consultation with the co - reviewers; • if a DPF company fails to comply within 25 days of the delivery of the advice and has offered no satisfactory explanation for the delay, the Lead DPA will give notice of the P anel’s intention to refer the matter to the relevant U.S. body 16 , or to conclude that the agreement to cooperate has been seriously breached and must therefore be considered null and void 17 . I n the latter case, the Lead DPA will inform the DoC so that the Data Privacy Framework List can be duly amended ; • act as single point of contact to the FTC, the DoC and other relevant public authorities in the US throughout the entire panel procedure and facilitate communication between and with the P anel. 7 Duties of co - Reviewers The duties of the co - Reviewers include: • support the Lead DPA when necessary or requested ; • provide comments on the draft advice as quickly as possible and within two weeks maximum to allow for further enquiry; if no comments are provided within this timeframe, it will be considered that the co - reviewers agree with the draft advice prepared by th e Lead DPA . The co - reviewers might request additional time if necessary and justified . 8 Co operation and communication Co mmunication between DPAs will be carried out in the framework of the cooperation tools used under Article 57(1)(a), (f) and (g) GDPR . The Lead DPA and the co - Reviewer DPAs will work together to reach consensus regarding the advice to be provided to the DPF company , when relevant . If consensus cannot be reached after several rounds of discussion , as a last resort a vote may be cast on the different options . The option that receives the simple majority of the votes of the P anel members will be selected. In case of a tie, the Lead DPA’s vote will prevail. 15 The Lead DPA should inform the EDPB, in order to make the information available on the EDPB website. 16 Namely, the FTC, DoT, or an other US Federal or state body with statutory powers to take enforcement action in cases of deception or misrepresentation . 17 Supplemental Principle 5, c ii. 9 | Adopted The same procedure applies for determining how to proceed in cases of non - compliance by the DPF company with the advice issued.