D&B has obtained certifications under multiple international data transfer frameworks, including the current EU-U.S. Data Privacy Framework, meaning personal data can flow from the EU, UK, and Switzerland to D&B's U.S. operations under these recognized legal mechanisms.
This analysis describes what Dun & Bradstreet's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
These certifications are the legal basis on which D&B transfers personal data from the EU, UK, and Switzerland to the United States; if a certification lapses or is challenged, the lawfulness of those transfers could be called into question.
The updated privacy policy removed explicit language describing how users can manage cookie preferences and enable chat functionality. Previously, the policy stated that users could click 'Manage Choices' to enable or disable specific cookies including 'Chat' cookies. The revised version no longer includes these detailed preference options in the displayed policy language. The terms now indicate that chat functionality requires accepting 'Chat Cookies,' but the granular control mechanisms previously described have been removed from the public policy disclosure.
View change record →The updated privacy statement removes extensive disclosures about Dun & Bradstreet's data processing practices, ethical commitments, certifications, and individual rights procedures. Previously, the policy described the company's core values, ethical principles, ISO certifications, cross-border privacy frameworks, data broker registrations in multiple states, and how individuals could exercise rights. The revised statement now provides minimal substantive guidance. Under the updated terms, users will find substantially less information about how their data is processed, what protections apply, and how to contact the company regarding their rights.
View change record →For EU, UK, and Swiss individuals whose data is processed by D&B, these certifications provide the legal mechanism for data being sent to or processed in the U.S. The EU-U.S. DPF replaced the invalidated Privacy Shield and is currently recognized under EU law, though its long-term legal stability has been subject to ongoing political and legal debate.
How other platforms handle this
to request that your data be transferred to a third party (data portability)
Your organization may allow you to access and export your data in order to back it up or transfer it to a service outside of Google.
Further, you may take legal actions in relation to any potential breach of your rights regarding the processing of your Personal Information, as well as to lodge complaints before the competent data prot...
"Since 2016, we have upheld multilateral standards to provide assurance for how we manage our cross-border privacy and data protection obligations and to support our certifications under the following frameworks recognized by regulators: EU-U.S. Privacy Shield (2016), Swiss-U.S. Privacy Shield (2017), EU-U.S. Data Privacy Framework (2023), Swiss-U.S. Data Privacy Framework (2023), UK Extension to EU-U.S. Data Privacy Framework (2023), APEC Cross-Border Privacy Rules System (2023), TRUSTe Responsible AI Certification (2024), Global Cross Border Privacy Rules (CBPR) (2025)Excerpt from Dun & Bradstreet's D&B Privacy Policy
REGULATORY LANDSCAPE: The EU-U.S.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
These certifications are the legal basis on which D&B transfers personal data from the EU, UK, and Switzerland to the United States; if a certification lapses or is challenged, the lawfulness of those transfers could be called into question.
For EU, UK, and Swiss individuals whose data is processed by D&B, these certifications provide the legal mechanism for data being sent to or processed in the U.S. The EU-U.S. DPF replaced the invalidated Privacy Shield and is currently recognized under EU law, though its long-term legal stability has been subject to ongoing political and legal debate.
ConductAtlas has identified this type of provision across 290 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Dun & Bradstreet.