UK-US ‘data bridge’ to take effect on 12 October

UK-US Data Bridge

The UK has now agreed to an extension for the transfer of personal data from the UK to the US, known as the UK Extension to the EU-US Data Privacy Framework, or the ‘UK-US Data Bridge’.  Taking effect from 12 October 2023, the UK-US Data Bridge provides a new legal mechanism under which UK organisations can send personal data to the US, provided that certain requirements are met.

How can the UK-US Data Bridge be used?

Before UK organisations start using the UK-US Data Bridge to transfer personal data to the US, they should first check that US recipients are certified with the Data Privacy Framework (DPF) as a participant in the UK-US Data Bridge by taking the following steps:

  • Check the DPF list to verify that the US recipient is an active DPF participant.
  • Confirm that the US recipient has signed up to the UK-US Data Bridge.
  • If transferring human resources data, the US organisation must have highlighted this on its DPF certification. UK organisations should check this by clicking on the organisation’s name in the DPF list and navigating to the relevant privacy policy under the “Privacy Policy” section of the record.

UK organisations wishing to send personal data to US organisations that are not on the DPF list must continue to reply on the established transfer mechanisms for the time being.