Safe Harbor

Get started

Legislative summary
The European Commission’s Directive on Data Protection prohibits the transfer of personal data from European organizations to non-European Union nations and organizations that do not adequately protect the safety and privacy of personal data. Upon passage of this comprehensive European legislation, all businesses and organizations in the United States that share data with European Union organizations were bound to comply with the regulations, which may have disrupted many types of trans-Atlantic business transactions. Due to the differences in approaches taken by the United States and European Union nations in protecting personal data privacy, the United States Department of Commerce, in consultation with the European Commission, developed a streamlined “ Safe Harbor” framework through which U.S. organizations may comply with the Directive on Data Protection.

Organizations participating in the Safe Harbor are committed to complying with these seven principles designed to ensure that personal data is properly used, controlled and protected: Notice, Choice, Onward Transfer, Access, Security, Data Integrity and Enforcement. Of particular significance to information technology:

• The Notice principle requires organizations to inform individuals about the purposes for which it collects information, such as through a privacy policy.
• The Security principle states that organizations will take reasonable precautions to protect personal data.
• The Enforcement principle mandates that organizations have procedures in place for verifying that security commitments are satisfied, such as through comprehensive security testing.

HP Application Security Center capabilities

• Assess your web applications for vulnerabilities that may result in the disclosure of sensitive or private information
• Verify that links to privacy policies exist at appropriate places in your web applications
• Get detailed security assessment reports categorized by Safe Harbor sections

Learn more