PrivacyTrust provides a dispute resolution service (independent recourse mechanism) to companies self-certifying their compliance pursuant to the EU-U.S. Data Privacy Framework (EU-U.S. DPF) and, as applicable, to the UK Extension to the EU-U.S. DPF, and/or the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF).

As such we will do the following:

  1. Acknowledge your complaint within 3 working days.
  2. Let you know if it is covered by the dispute resolution process
  3. Work with you and the company concerned to investigate your complaint
  4. Act in a fair and impartial way when reaching the outcome
  5. Reach an outcome within 45 days
  6. Provide this service free of charge to the person making the complaint

Each year we will publish information on how many disputes we have resolved, the average time taken and the outcome, including sanctions and remedies.

Potential outcomes from disputes include instructing the company to create or change processes, instructing them to immediately cease processing of personal identifiable information and deletion of effected personal information. The company’s relevant PrivacyTrust certification may also be temporarily or permanently revoked.

Our 2022/2023 Dispute Resolution report is now available online.

Previous Reports:


You may submit a complaint via a link on the company’s privacy policy or using this dispute resolution form.