Upwork removed detailed language about its compliance with the EU-U.S. Data Privacy Framework and Swiss-U.S. Data Privacy Framework, which previously explained how it handles personal data from EU, UK, and Swiss residents. The updated policy now contains only a single sentence directing users to contact Upwork if they want to see data transfer mechanism documents. This change simplifies the privacy notice but removes specific commitments about how cross-border data transfers are governed.
Data controllers and enterprises using Upwork as a vendor: Upwork no longer explicitly commits to treating EU, UK, and Swiss residents' data under Data Privacy Framework principles, which may affect how enterprises document their reliance on DPF for cross-border transfers involving Upwork.
The updated policy no longer explicitly commits to treating EU, UK, and Swiss residents' data according to Data Privacy Framework Principles or describes Upwork's certification status with the U.S. Department of Commerce. This removes transparency about the legal mechanism protecting cross-border data transfers for affected users. The policy retains a right to request data transfer documents by contacting Upwork, but no longer explains what frameworks or certifications apply.
→ If you are an EU, UK, or Swiss resident, contact Upwork to request copies of the data transfer mechanism documents to understand how your personal data is currently protected in cross-border transfers.
→ If your organization uses Upwork and processes personal data from EU, UK, or Swiss residents, request written confirmation from Upwork of the legal basis and mechanism for cross-border data transfers.
Deleted explicit statements that Upwork certifies to U.S. Department of Commerce compliance with EU-U.S. DPF and Swiss-U.S. DPF Principles for cross-border personal data transfers.
Policy now directs users to contact Upwork to exercise legal rights to see data transfer mechanism documents, but no longer specifies which frameworks those documents reference.
This change record describes what was added, removed, or modified in the document. Analysis reflects what the updated agreement states or permits. It does not constitute a legal determination about enforceability. Applicability may vary by jurisdiction. Methodology
Upwork removed substantive Data Privacy Framework (DPF) compliance language while retaining a narrow contact mechanism for requesting data transfer documents. This change affects how the company represents its cross-border data transfer compliance to EU, UK, …
Regulatory exposure, obligation change, escalation trigger, board-ready language, and recommended action for legal and compliance teams.
Unlock the full institutional analysis — InsightConductAtlas provides verified policy intelligence sourced directly from platform documents. All analysis is intended to support, not replace, legal and compliance review. Record CA-C-001512.
Upwork updated its Terms of Service on July 20, 2026 (detected July 21, 2026) with three categories of changes: structural …
Upwork added a new Upwork Now Beta Addendum effective July 8, 2026, governing a pilot program that allows clients and …
Upwork added a new Beta Addendum governing Upwork Now, a pilot feature enabling faster, session-based hiring and freelancer outreach. The …
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
Get alerted when this policy changes again, including what changed and why it matters.