What is the UK-US data bridge?

The UK-USA adequacy regulation came into force on 12 October 2023. An adequacy regulation (also known as a data bridge) is a means by which Personal Data may be transferred outside of the United Kingdom. But what does this mean for you?  

What is Personal Data?

Personal Data is any data that relates to an individual which identifies them, such as a person’s name, address or date of birth.

The handling of Personal Data is known as ‘processing’. When organisations process Personal Data, they must do so securely in accordance with the General Data Protection Regulations (the “GDPR”).

Personal Data may be processed for various different reasons. For example, an employer might process the Personal Data of its employees for the purposes of communicating with them or a doctor’s surgery might process the Personal Data of its patients for the purposes of providing treatment.

Processing Personal Data outside of the United Kingdom

There may be instances where Personal Data needs to be processed outside of the United Kingdom. This might happen where you purchase goods from the United Kingdom and the goods are shipped to you from another country. This is known as an ‘international transfer’ because your Personal Data, in this example your name and address, is received by a party outside of the United Kingdom.

International transfers are subject to additional rules to ensure the protection of Personal Data. An international transfer may only take place if the transfer can take place securely. A data bridge is one of the means by which Personal Data may be transferred securely to another country.

What is a data bridge?

A data bridge is the decision which permits Personal Data to be transferred from the United Kingdom to another country. If a data bridge applies to the country in question, then Personal Data can be transferred freely from the UK to the other country without the need for additional safeguards. It is important to remember that the data bridge isn’t automatically reciprocal.

Data bridges may be implemented in order to maintain the collaborative relationship the UK has with the country in question. They allow for UK businesses to expand and even benefits consumers in the UK, as they have increased access to goods and services in other countries.

The UK-USA data bridge

The USA and the EU developed a framework known as the EU-US Data Privacy Framework. The Framework sets out various principles which must be complied with in order to demonstrate a commitment to data protection. This is applied as an opt-in scheme in the USA, where US-based companies must comply with the relevant principles set out in the Framework in order to be ‘certified’ to receive Personal Data from the EU.

The UK-USA data bridge is an ‘extension’ to this Framework which allows UK businesses and organisations to securely transfer Personal Data to any certified organisations in the USA.

Is the data bridge a good thing?

The UK GDPR places onerous conditions on organisations that process Personal Data in order to ensure that it is processed securely and given sufficient protection.

The data bridge will ensure that the principles of the UK GDPR are maintained when Personal Data is transferred outside of the United Kingdom to the USA. This is because the certified organisations in the USA that receive Personal Data are required to maintain the standards set out in the Framework, ensuring that Personal Data will treated with the same or equivalent protection in the USA as it is in the United Kingdom.  

If you have any further questions on how the UK-US data bridge might affect your business, we would be more than happy to help. Please contact Kavita Raikundalia on 01908 247 247 or by email to [javascript protected email address].  

The information on this site about legal matters is provided as a general guide only. Although we try to ensure that all of the information on this site is accurate and up to date, this cannot be guaranteed. The information on this site should not be relied upon or construed as constituting legal advice and Howes Percival LLP disclaims liability in relation to its use. You should seek appropriate legal advice before taking or refraining from taking any action.