Certification scheme, currently operational with the US, which places requirements on companies to protect personal data and provide appropriate redress for individuals.