United Kingdom. Data localisation / cross-border. Statutory instrument (SI 2023/1028)
UK–US Data BridgeData Protection (Adequacy) (United States of America) Regulations 2023 – UK Extension to the EU–US Data Privacy Framework ('UK–US Data Bridge')
Partly verified
Medium confidence.Status depends on continued operation of the EU–US DPF and PCLOB/EO 14086 safeguards; monitor US developments.
§1Summary
- Synopsis
UK adequacy regulations allowing personal data to flow to US organisations certified to the UK Extension of the EU–US Data Privacy Framework without further safeguards. It depends on the US Executive Order 14086 redress mechanism being extended to the UK.
- Key themes
- Unique features
Excludes some data (e.g. journalistic data) and requires explicit flagging of special category data by exporters such as genetic, biometric and criminal data.
- SaaS relevance
A UK SaaS provider can use US vendors certified to the UK Extension without an IDTA; US SaaS providers can self-certify to receive UK data.
§2Obligations
- Cross-border transfers
- Partial adequacy for certified US organisations
§3Dates
- Key dates
- Adopted
- In force
§4Text and authority
- Text
- Authoritative text legislation.gov.uk
- Authority
- Information Commissioner's Office (ICO); DSIT
§5Where it applies
- Domestic law of
- United Kingdom
§6Sources and verification
- Sources consulted
- Verification
Medium confidence.
Partly verified
Medium confidence.Status depends on continued operation of the EU–US DPF and PCLOB/EO 14086 safeguards; monitor US developments.