From today, the UK Extension to the EU–US Data Privacy Framework, known as the UK–US data bridge, is in force.
UK organisations can transfer personal data to US organisations that have certified under the Data Privacy Framework and opted in to the UK Extension, without needing an IDTA, the UK Addendum or a transfer risk assessment.
Practical steps
- Check the DPF list to confirm your US recipients are certified and have signed up to the UK Extension.
- Note that special category data must be identified as sensitive when transferred.
- Update your records of processing and privacy notices.
- Keep IDTA or Addendum clauses in contracts as a fallback in case the framework is challenged.
Source: Data Protection (Adequacy) (United States of America) Regulations 2023 (legislation.gov.uk)
This update is general information, not legal advice. If you would like help assessing the impact on your information security or privacy programme, contact us.
