UK government establishes UK-U.S. Data Bridge

The announcement was made on September 21 by Michelle Donelan, the UK Secretary of State for Science, Innovation, and Technology.

Accompanying the announcement was a series of supporting documents, including the Data Protection (Adequacy) (United States of America) Regulations 2023, a fact sheet for UK organizations, an assessment of the UK Extension by the Information Commissioner’s Office, and a comprehensive analysis of the UK Extension by the UK Department for Science, Innovation, and Technology.

The UK-U.S. Data Bridge adequacy regulations took effect on October 12. This means that UK businesses can begin transferring personal data to certified U.S. organizations without the need for further safeguards. Those safeguards include those specified in Article 46 (such as binding corporate rules, the International Data Transfer Agreement, or the International Data Transfer Addendum to the European Commission’s Standard Contractual Clauses) and Article 49 (derogations for specific situations).

An organization that already participates in the EU-U.S. Data Privacy Framework (“EU-U.S. DPF”) and intends to extend its participation to cover the UK (and, as applicable, Gibraltar) would need to add the UK Extension either as part of its annual re-certification process or, if doing so outside of the annual re-certification process, add the UK Extension no later than six months from July 17, 2023.

As a reminder, the European Commission adopted its adequacy decision on July 10. Organizations that previously self-certified their commitment to comply with the predecessor EU-U.S. Privacy Shield Framework and wish to continue participation under the new E.U.-U.S. DPF had three months (until last week) to update their privacy policies to refer to the new framework. For more information about the EU-U.S. DPF, please see our previous blog post on the European Commission’s adequacy decision.