Upwork's privacy policy now includes explicit language describing compliance with the U.S. Data Privacy Framework (DPF) for EU, UK, and Swiss residents' data. Previously, the policy stated only that users could request copies of data transfer mechanism documents. The updated policy adds a dedicated Data Privacy Framework section confirming Upwork's certification under the DPF frameworks and stating that if any conflict exists between the privacy policy and DPF principles, the DPF principles will govern.
The updated policy now explicitly states that Upwork complies with the U.S. Data Privacy Framework and has certified to the U.S. Department of Commerce that it adheres to DPF principles when processing personal data from EU, UK, and Swiss residents. The policy establishes that if any conflict exists between Upwork's privacy policy and DPF principles, the DPF principles will govern. This creates an explicit legal hierarchy for data protection standards applicable to residents of those jurisdictions. Users from affected regions can visit https://www.dataprivacyframework.gov/ to view Upwork's certification and learn more about the DPF program.
The updated policy formalizes the legal framework governing how Upwork transfers and processes EU, UK, and Swiss resident data. By establishing explicit DPF compliance and stating that DPF principles take precedence over conflicting policy terms, Upwork creates a clear legal hierarchy for data protection standards and provides regulatory clarity on the transfer mechanism used. This is operationally significant for organizations that depend on Upwork's compliance posture to satisfy their own GDPR and UK GDPR obligations.
→ Visit https://www.dataprivacyframework.gov/ to view Upwork's certification and learn about DPF principles
→ Your personal data will be transferred and processed under the Data Privacy Framework principles as stated in the updated policy
Policy now explicitly certifies Upwork's adherence to DPF principles for EU, UK, and Swiss resident data processing
Updated terms establish that if any conflict exists between the privacy policy and DPF principles, the DPF principles govern
Policy clarifies that Upwork may have DPF responsibilities if a third-party agent processes transferred data inconsistently with DPF and Upwork is responsible for resulting damages
This change record describes what was added, removed, or modified in the document. Analysis reflects what the updated agreement states or permits. It does not constitute a legal determination about enforceability. Applicability may vary by jurisdiction. Methodology
Upwork formalized its Data Privacy Framework compliance framework in the privacy policy, adding explicit language confirming certification and establishing that DPF principles supersede conflicting privacy policy terms. This change engages the Data Privacy Framework, a mechanism recognized by the EU and UK regulators as adequate for data transfers to the US. Organizations that use Upwork as a vendor and have EU, UK, or Swiss user data should verify that their data processing agreements reference or accommodate this DPF-based transfer mechanism. The change does not create new processing obligations but formalizes the legal basis for transfers previously operated under SCCs or other mechanisms.
Data Privacy Framework (DPF), GDPR Article 46, UK GDPR Chapter 5, Swiss Federal Data Protection Act
Full compliance analysis
Obligation analysis, escalation trigger, board language, and recommended action.
Watcher: regulatory citations + obligations. Professional: full compliance memo.
ConductAtlas provides verified policy intelligence sourced directly from platform documents. All analysis is intended to support, not replace, legal and compliance review. Record CA-C-001925.
See the full side-by-side comparison of every sentence added, removed, and modified.
🔒 Full diff — WatcherUpwork removed detailed language about its compliance with the U.S. Data Privacy Framework (a legal mechanism for transferring personal data …
Upwork removed detailed language about its compliance with the EU-U.S. Data Privacy Framework and Swiss-U.S. Data Privacy Framework, which previously …
Get alerted when this policy changes again — including what changed and why it matters.
Prefer a weekly summary instead?
Get the biggest policy changes across 320+ platforms every Sunday.