{"id":184036,"date":"2023-11-22T03:48:27","date_gmt":"2023-11-22T03:48:27","guid":{"rendered":"https:\/\/legalvision.co.uk\/?p=184036"},"modified":"2023-11-23T01:37:40","modified_gmt":"2023-11-23T01:37:40","slug":"us-data-bridge","status":"publish","type":"post","link":"https:\/\/legalvision.co.uk\/data-privacy-it\/us-data-bridge\/","title":{"rendered":"What is the UK-US Data Bridge?"},"content":{"rendered":"\n

Your business must comply with international data transfer laws if it sends personal data outside the UK. The UK made an important adequacy decision in October 2023, which allows UK organisations to transfer personal data to US organisations that have signed up to a certification scheme known as the UK-US Data Bridge. This article will explore the UK-US Data Bridge and the key issues UK organisations should understand. <\/p>\n\n\n\n

Rules on Transferring Personal Data Outside of the UK<\/h2>\n\n\n\n

UK organisations must comply with strict international data transfer law rules when transferring personal data to countries outside the UK. The UK General Data Protection Regulation<\/a> (UK GDPR<\/strong>) sets out rules to ensure that personal data is adequately protected when transferred outside the UK.  <\/p>\n\n\n\n

Generally, transferring personal data outside the UK is prohibited unless your organisation can rely on a valid exemption. This is because some countries have inadequate privacy protection laws. Consequently, transferring personal data to those countries could put individuals\u2019 data at risk. <\/p>\n\n\n\n

Various exceptions allow organisations to transfer personal data to countries outside the UK. The most common exceptions include transferring personal data to a country outside the UK deemed to have an \u2018adequate\u2019 level of data protection. These are commonly known as \u2018adequacy decisions\u2019. <\/p>\n\n\n\n

\n

Alternatively, businesses may transfer personal data to a country outside of the UK if appropriate safeguards have been put in place to protect the transfer of personal data. \u2018Appropriate safeguards\u2019 most commonly include data protection contractual documents approved by regulators, known as \u2018Standard Contractual Clauses\u2019 or the UK\u2019s \u2018International Data Transfer Agreement\u2019.<\/p>\n<\/div>\n\n\n\n

Currently, the following countries have been deemed \u2018adequate\u2019 by the UK:<\/p>\n\n\n\n

    \n
  • Andorra;<\/li>\n\n\n\n
  • Argentina;<\/li>\n\n\n\n
  • Canada (commercial organisations only);<\/li>\n\n\n\n
  • Faroe Islands;<\/li>\n\n\n\n
  • Guernsey;<\/li>\n\n\n\n
  • Isle of Man;<\/li>\n\n\n\n
  • Israel;<\/li>\n\n\n\n
  • Japan (private-sector organisations only);<\/li>\n\n\n\n
  • Jersey;<\/li>\n\n\n\n
  • New Zealand;<\/li>\n\n\n\n
  • Switzerland;<\/li>\n\n\n\n
  • Uruguay; and <\/li>\n\n\n\n
  • the EU member state and European Economic Area members. <\/li>\n<\/ul>\n\n\n\n
    \n