ICO clarifies the independent status of the UK-US data bridge

August 5, 2026

The ICO has updated its international transfers guidance to emphasise that the UK Extension to the EU–US Data Privacy Framework is legally separate from the European Commission’s adequacy decision for the US. The regulator notes that this has always been the legal position, but has amended its guidance to make the distinction explicit.

This means that a future decision by the European courts invalidating the EU-US Data Privacy Framework would not automatically invalidate the UK Extension. Nevertheless, both arrangements depend upon substantially the same underlying commitments and safeguards in the US. If those protections were weakened or withdrawn, the UK government would need to review whether the Extension continued to provide an adequate level of protection for personal data transferred from the UK.

The clarification should not be understood as removing the need for checks before a transfer takes place. A UK exporter must confirm that the US recipient appears on the Data Privacy Framework list with an active status, has specifically self-certified under the UK Extension and is certified to receive the relevant category of HR or non-HR data. Additional requirements must be considered when human-resources information is being transferred.

Organisations should ensure that their transfer registers, privacy information and contracts accurately identify the UK Extension as the applicable transfer mechanism, rather than referring indiscriminately to the EU-US framework. It would also be prudent to retain contingency plans for moving to an alternative safeguard if changes in the United States prompt the UK government to review the arrangement.

There will be a Workshop on Geopolitics at Play: Legitimising International Data Transfers in 2026 at the 25th Annual Data Protection Compliance Conference taking place on 23rd, 24th and 26th September. The leader of the Workshop, Eduardo Ustaran, who is also author of the chapter on ‘Data Exports’ in the forthcoming seventh edition of Data Protection: A Practical Guide to UK and EU Law (Oxford University Press) commented: “The ICO makes it clear that the UK is not simply piggy-backing on the arrangement between the EU and the US in relation to international data transfers, but that the UK Government will take its own view of the adequacy of the US safeguards in place. With that, the ICO is seeking to reassure UK data exporters against the political uncertainties affecting this important mechanism for data transfers.”

Special Category Data — Getting it Right

Special category data errors sit behind the majority of ICO fines. Gain detailed, practical knowledge of the definitions, conditions and compliance systems.

AI & Data Protection

Practical steps controllers can take today to manage AI compliance risk. Fairness, transparency, lawfulness and security across the AI lifecycle.

Stay informed - Sign up to receive PDP Email News Updates

Analysis from PDP’s experts on the changes that matter, written for practitioners