Upwork removed detailed language about its compliance with the U.S. Data Privacy Framework (a legal mechanism for transferring personal data from Europe and Switzerland to the U.S.) but kept a single sentence stating you can request copies of data transfer documents. This means the policy no longer explicitly commits to Data Privacy Framework protections or acknowledges regulatory oversight, which may create uncertainty about how your data is legally protected if you are in the EU, UK, or Switzerland.
Data controllers: Organizations that rely on Upwork to process EU, UK, or Swiss data no longer have a policy-level statement that DPF Principles govern that processing.
Upwork's privacy policy previously disclosed that it complied with the U.S. Data Privacy Framework and certified adherence to its Principles regarding how it processes personal data from EU, UK, and Swiss residents. The updated policy removes nearly all of this language, including the explicit commitment to Data Privacy Framework Principles and the statement that those Principles would govern in case of conflict with other policy terms. Users in the EU, UK, and Switzerland no longer have a clear, policy-level statement of the legal framework protecting their data when transferred to the U.S., which may reduce transparency about data protection safeguards. You may contact Upwork to request copies of the data transfer mechanism documents it uses.
→ If you are in the EU, UK, or Switzerland, review Upwork's updated privacy policy to understand what data protection framework now applies to your personal data.
→ Contact Upwork directly to request copies of the data transfer mechanism documents it uses, as specified in the updated policy.
ConductAtlas has recorded 2 material changes to this document (since April 2026).
Across all monitored documents, Upwork has made 3 significant changes.
2 of Upwork's significant changes have been classified as negative for consumers.
Removed language establishing that DPF Principles govern processing of EU, UK, and Swiss personal data and take precedence over other policy terms.
Removed detailed statements of Upwork's certification under EU-U.S. DPF, UK Extension, and Swiss-U.S. DPF, including references to certification verification.
Removed language addressing Upwork's responsibilities when transferring DPF-received data to third-party service providers.
This change record describes what was added, removed, or modified in the document. Analysis reflects what the updated agreement states or permits. It does not constitute a legal determination about enforceability. Applicability may vary by jurisdiction. Methodology
Upwork removed substantive Data Privacy Framework compliance disclosures from its privacy policy on May 1, 2026 (effective April 30, 2026), including its certification statement and conflict-of-law language favoring DPF Principles. The change eliminates transparency about …
Regulatory exposure, obligation change, escalation trigger, board-ready language, and recommended action for legal and compliance teams.
Unlock the full institutional analysis — InsightConductAtlas provides verified policy intelligence sourced directly from platform documents. All analysis is intended to support, not replace, legal and compliance review. Record CA-C-001513.
Upwork updated its Terms of Service on July 20, 2026 (detected July 21, 2026) with three categories of changes: structural …
Upwork added a new Upwork Now Beta Addendum effective July 8, 2026, governing a pilot program that allows clients and …
Upwork added a new Beta Addendum governing Upwork Now, a pilot feature enabling faster, session-based hiring and freelancer outreach. The …
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
Get alerted when this policy changes again, including what changed and why it matters.