EU-US Data Privacy Framework Template Complaint Form for Submitting Complaints to EU DPAs related to the Data Privacy Framework Principles - version 2.0

EU - US Data Privacy Framework Template Complaint Form for Submitting Complaints to E U DPAs related to the Data Privacy Framework Principles 1 Version 2 .0 Adopted on 15 January 2026 1 References to the EU should be understood as also including the three EEA countries not part of the EU. 1 | Adopted Version history Version Date Adoption information version 1.0 17 April 2024 adoption of the Template Complaint Form version 2 . 0 15 January 2026 adoption of updated version 2 | Adopted 3 | Adopted C omplaint form for DPF complaints In order to facilitate the handling of your complaint, you should provide your DPA with the following information. The same information should be provided to the DPA even if you decide not to use this complaint form. Please note that the EDPB is not competent to deal with your complaint and should not be contacted in this respect. When filling in the complaint form, you should aim at providing as many details as possible on the alleged violation and processing. This will facilitate the handling of your complaint by the DPA. 1. Personal information: a. Name or other type of identifier used by the DPF company to identify you, such as user name (mandatory in the case in which the right of access is at stake) 2 : b. Preferred contact ( e.g. phone number, e - mail address, mailing address) : c. Your full name (for contact purposes) : 2. If known, please provide the name and contact information of the company in the EEA that sent your data to the US. 3. To the extent possible, explain the reasons why you believe (or know) that your personal data was transferred under the DPF (for example, the company in the EEA processing your personal data provides this information in their privacy notice). 4. If known, please provide the details (e.g. name and address) of the DPF compan y to which your personal data was transferred . 5. Please explain why you believe that the DPF has been infringed by the DPF company. If possible, please specify which DPF Principles 3 you consider to be violated. 2 If your complaint concerns your right of access to your personal data, it will be necessary to provide this information. If y ou do not provide this information, the DPF company will not be able to identify you in order to handle the case. DPAs may also re quest additional information to verify the information provided (authentication). 3 https://www.dataprivacyframework.gov/program - articles/Participation - Requirements - Data - Privacy - Framework - (DPF) - Principles 4 | Adopted 6. If you seek information on the processing of your personal data by the DPF company , or a remedy for an alleged failure of the DPF company to comply with the DPF , please provide as many details as possible on the specific information or remedy you seek. 7. Did you already try to resolve your case by contacting the relevant DPF company(ies) directly? 4 If yes, what was the outcome? Please provide the previous correspondence in that matter. 8. What other measures have you taken to obtain the information or remedy requested and what response have you received? 4 Please note that in most cases, it would be advisable that you first contact the DPF company to attempt to resolve your case. Your national EU DPA can help you to do so. 5 | Adopted Glossary GDPR: Regulation 2016/679/EU of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC. EU - U.S. Data Privacy Framework or DPF: self - certification mechanism for companies in the U.S. The European Commission consider s that transfers of personal data from the EEA to companies in the U.S. certified under the DPF enjoy an adequate level of protection 5 . As a result, personal data can be transferred to U.S. certified companies, without the need to put in place further safeguards or obtain an authorisation. More information can be found in the EDPB FAQs 6 . DPF Principles: t he DPF relies on commitments taken by companies in the U.S. to respect its principles, rules and obligations related to the processing of personal data . The DPF Principles are available here 7 DPF company: a n organisation 8 in the U.S. that holds an active self - certification under the DPF. You can consult the list of companies self - certified under the DPF here 9 . DPA: Data Protection Authority within the European Economic Area. You can consult the list of DPAs and their contact details here 10 . FTC : t he U.S. Federal Trade Commission DoT: the U.S. Department of Transportation DoC : the U.S. Department of Commerce Informal Panel of EU DPAs : a panel composed by several EU DPAs that wil l be set up in order to handle complaint s concerning HR Data 11 tra nsferred from an EU entity to a DPF company or to handle complaints related to other types of personal data when the DPF company has opted for dispute resolution by the Panel 12 . DPF complaints: complaints concerning the compliance of a DPF company with the DPF Principles, with respect to the personal data of an individual that has been transferred from the EEA to that company under the DPF . 5 The decision on the adequacy of the EU - U.S. Data Privacy Framework was adopted by the European Commission on July 10, 2023. It was designed by the European Commission and the U.S. Department of Commerce to replace the Privacy Shield Decision (EU) 2016/125 0 which was declared invalid by the European Court of Justice in 16 July 2020 in Case C - 311/18, Data Protection Commissioner v Facebook Ireland Limited and Maximillian Schrems (Schrems II). The adequacy decision is available here: https://eur - lex.europa.eu/legal - content/EN/TXT/PDF/?uri=CELEX:32023D1795 6 EU - US Data Privacy Framework FAQ for European individuals : https://www.edpb.europa.eu/our - work - tools/our - documents/other - guidance/eu - us - data - privacy - framework - faq - european - individuals - 0_en ; EU - U.S. Data Privacy Framework F.A.Q. for European businesses - version 2.0: https://www.edpb.europa.eu/our - work - tools/our - documents/other - guidance/eu - us - data - privacy - framework - faq - european - businesses - 0_en 7 https://www.dataprivacyframework.gov/program - articles/Participation - Requirements - Data - Privacy - Framework - (DPF) - Principles 8 In this context, “company” and “organisation” are used indistinctively . 9 https://www.dataprivacyframework.gov/list 10 https://www.edpb.europa.eu/about - edpb/about - edpb/members_en 11 HR Data refers to human resources data collected in the context of an employment relationship . 12 The Rules of Procedure of the Informal Panel are available here: https://www.edpb.europa.eu/our - work - tools/our - documents/other - guidance/rules - procedure - informal - panel - eu - dpas - according - eu - 0_en 6 | Adopted EEA: European Economic Area General information Under the DPF, individuals have the right to submit a complaint if they believe a company in the U.S. has violated the DPF Principles when handling their personal data transferred from the EEA to that company under the DPF . Individuals are encouraged to first raise a complaint with the DPF company, which must respond within 45 calendar days. Nevertheless, individuals can always lodge a complaint relating to a DPF company’s compliance with the DPF Principles directly with a DPA . For more information on individuals’ rights under the DPF and the handling of DPF complaints, you can check the EDPB FAQ for individuals 13 . What is the purpose of the complaint form and to whom is it addressed? The complaint form aims at facilitating the submission of DPF complaints. It can be used by individuals who wish to file a complaint with a DPA against a DPF company that, in their view, has violated the DPF Principles when handling their personal data t hat has been transferred from the EEA to that company under the DPF . The use of the complaint form is not mandatory, although it is highly encouraged. This complaint form is not suitable i f your complaint concerns the access to your personal data by U.S. national security authorities . In that case, please check the EDPB Information Note on the matter . 14 This complaint form is not suitable if your complaint concerns alleged violations of the GDPR by a company, unrelated to the DPF Principles. Information regarding the processing of your personal data Who will be handling the data provided by this form and how is your personal data protected? Your DPA is the data controller of the personal data you provide in your complaint. The DPA will process the personal data in the performance of its tasks carried out in the public interest in accordance with Article 6(1)(e) GDPR with particular reference to the task s referred to in Article 57(1)(a),(f) and (g). Where the Informal Panel of EU DPAs is competent, your personal data will be shared with the EU DPAs participating in the panel. 13 EU - US Data Privacy Framework FAQ for European individuals : https://www.edpb.europa.eu/our - work - tools/our - documents/other - guidance/eu - us - data - privacy - framework - faq - european - individuals - 0_en 14 https://www.edpb.europa.eu/system/files/2024 - 04/edpb_information - note_dpf - redress - mechanism - national - security - purposes_en.pdf 7 | Adopted The processing of your personal data by the EU DPAs will be done in accordance with EU data protection law, for the sole purpose of handling your complaint. Your personal data will be stored for the time necessary to process the complaint and in accordance with the applicable law s of the relevant Member States ( see the information notice of each DPA) . Your personal data will be submitted to restricted access and available only to authorised personnel within the relevant DPA s . You can exercise your right s of access and rectification, erasure or limitation of the processing or to oppose the processing (Articles 15 et seq. GDPR) by contacting, in particular, the DPA you lodged the complaint with . Will your personal data be transferred to companies in the U.S. or to U . S . authorities? When possible, your complaint will be handled without disclosing your personal data to the concerned DPF company or U.S. authorities , in compliance with the principle of data minimisation. However, in some cases the handling of your complaint might require the transfer of your personal data to the concerned DPF company and/or U . S . authorities ( namely, the DoC, FTC and/or DoT ). Such personal data may include your name, any other identifier you used when communicating with the DPF company, or any other personal information that has been processed by the DPF company and is part of your complaint . If the transfer turns out to be necessary in order to handle your complaint, you will be specifically informed before the data is transferred and you will be given the opportunity to decide if you wish to proceed. The outcome of the complaint procedure might be published, if appropriate. However, your personal data will not be disclosed.