Data Protection (Adequacy) (United States of America) Regulations 2023 (the UK-US data bridge) (SI 2023/1028, reg 3(2))
UK personal data can go to a US buyer without further tools only if the buyer is on the DPF list and participates in the UK Extension. A buyer certified for the EU alone does not cover UK data.
Dated 18 Oct 2026Source checked 18 Oct 2026Basis: primary text
In the source's own words
“A transfer described by this paragraph is a transfer of personal data which- (a) is to a person in the United States of America who is indicated on the Data Privacy Framework List as participating in the UK Extension to the EU-US Data Privacy Framework; and (b) will be subject to the EU-US Data Privacy Framework Principles on receipt by that person.”
Where it was read
Figures it counts in
It is shown on its own, not counted into a figure.
Cited in these 3 guides