Can UK Companies Store Data in the US?

Yes, UK companies can now store data in the US under certain conditions. This is possible due to the new adequacy decision made by the UK government, allowing personal data to be transferred freely to US organisations that are signed up to the ‘UK-US Data Bridge’ since 12th October 2023.

In the past, transferring personal data from the UK to the US was challenging due to concerns over US law enforcement's unrestricted access to data. Previous attempts to create safe data transfer mechanisms, such as the EU-U.S. Privacy Shield, were invalidated due to these privacy concerns. However, the new UK-US Data Bridge arrangement changes this, enabling UK organisations to transfer personal data to the US without needing additional safeguards, provided the US organisations are self-certified under the Data Privacy Framework (DPF) and its UK extension. This simplifies the data transfer process significantly.

However, UK businesses must verify that the US organisations they transfer data to are self-certified under both frameworks. If a US organisation is not certified, UK companies must use alternative safeguards, such as the International Data Transfer Agreement or the UK's Addendum to the EU Standard Contractual Clauses, to ensure compliance. It's also important to mention that the UK-US Data Bridge may not be suitable for all types of data transfers, particularly those involving special category personal data.