The UK–US Data Access Agreement, made under the UK’s Crime (Overseas Production Orders) Act 2019 and the US CLOUD Act, comes into force today.
It allows UK law enforcement to apply for orders requiring US-based communications service providers to produce stored electronic data directly for the investigation of serious crime, and vice versa, without going through the slower mutual legal assistance process.
Implications for service providers
- UK providers may receive production orders from US authorities.
- Orders can carry non-disclosure requirements that prevent the provider from telling the customer.
- Providers need clear, secure procedures for receiving, validating and responding to such orders.
Customers should factor these arrangements into supplier due diligence and international transfer risk assessments.
Source: UK–USA Agreement on Access to Electronic Data, Treaty Series No. 33 (2024) (GOV.UK)
This update is general information, not legal advice. If you would like help assessing the impact on your information security or privacy programme, contact us.
