Commission renews data adequacy decisions enabling personal data flows between the EU and the UK

The European Commission has renewed the two adequacy decisions adopted in 2021 that govern the transfer of personal data between the European Economic Area and the United Kingdom. The renewal confirms that the UK’s data protection framework continues to offer safeguards that are considered essentially equivalent to those provided under EU law.

The decision follows a technical extension adopted in June 2025, which temporarily prolonged the existing adequacy arrangements for six months while the Commission assessed changes to the UK legal framework introduced through the Data (Use and Access) Act. That interim measure was necessary because the original adequacy decisions were due to expire on 27 December 2025.

The renewed adequacy decisions cover both the General Data Protection Regulation and the Law Enforcement Directive, ensuring continuity for data transfers related to commercial activities as well as cooperation in criminal justice and law enforcement. Their adoption follows a positive opinion from the European Data Protection Board and approval by EU member states through the comitology procedure.

The new decisions include a sunset clause of six years and will remain in force until 27 December 2031, with the possibility of renewal. The Commission, together with representatives of the European Data Protection Board, will review how the decisions function after four years to assess whether the UK framework continues to align with EU data protection standards.

Adequacy decisions are a key mechanism under EU data protection law, allowing personal data to be transferred to non-EU countries without additional safeguards where an adequate level of protection is ensured. In this case, the Commission concluded that the UK’s legal regime continues to meet that threshold despite recent legislative changes.

According to the Commission, the renewal provides legal certainty for organisations operating across the EU and the UK, supporting ongoing data-driven cooperation while maintaining established data protection guarantees.