Department Of Commerce Extends The Data Privacy Framework With UK-U.S. "Data Bridge": Key Takeaways For Multinational Employers

Following on the heels of the launch of the EU-U.S. Data Privacy Framework (DPF)¹ this summer, the U.S. Department of Commerce has extended the DPF to cover transfers of personal data from the United Kingdom (UK) (and Gibraltar) to the United States, in addition to transfers from the European Union to the United States. As of October 12, 2023, employers currently certified to the DPF can expand their certification to cover the transfer to the United States of the personal data of current and former applicants and employees who reside in the UK ("UK HR Data").

Formally termed the UK Extension to the EU-U.S. Data Privacy Framework (the "Extension"), but commonly referred to as the UK-U.S. "data bridge," the expansion of the DPF to cover UK personal data is the result of the UK government adopting The Data Protection (Adequacy)(United States of America) Regulations 2023 ("Adequacy Decision") and the U.S. Attorney General designating the UK as a "qualifying state" by