The Commission has renewed the two 2021 adequacy decisions for the free flow of personal data with the United Kingdom. The decisions ensure that personal data can continue flowing freely and safely between the European Economic Area (EEA) and the United Kingdom, as the UK legal framework contains data protection safeguards that are essentially equivalent to those provided by the EU.
In June 2025, the Commission had adopted a technical extension of the 2021 adequacy decisions with the United Kingdom – one under the General Data Protection Regulation and the other concerning the Law Enforcement Directive – for a limited period of six months, as they were set to expire on 27 December this year. This extension allowed the Commission to conduct a thorough assessment of the legal framework in the UK as amended by the Data (Use and Access) Act.
The adoption of the renewal decisions follows the European Data Protection Board’s opinion and the Member States’ green light in the so-called comitology procedure.
The new decisions are subject to a sunset clause of six years, running until 27 December 2031, with the possibility to be renewed. The Commission together with representatives of the European Data Protection Board will review the functioning of the adequacy decisions after a period of four years.
Background
The European Commission has the competence to determine, on the basis of the General Data Protection Regulation, whether a country or international organisation outside the EU ensures an adequate level of data protection. Following this, the Commission might initiate the process for the adoption of an adequacy decision, which allows the free flow of personal data from the EU and the European Economic Area (EEA) to a third country or international organisation without further obstacles.
For More Information
Data protection adequacy for non-EU countries
UK Adequacy: Renewal decision under the GDPR
