EDPB adopts key opinions on data transfers and adequacy decisions

The European Data Protection Board (EDPB) has adopted two major opinions affecting international data transfers and the UK’s data adequacy status.

For the first time, the EDPB assessed a draft adequacy decision concerning an international organisation — the European Patent Organisation (EPO). This marks a new precedent, as adequacy decisions previously applied only to countries or territories. The EDPB welcomed the move, noting that the EPO’s data protection framework largely aligns with EU standards. If adopted, this decision will enable personal data to flow legally and safely from the EU to the EPO.

An adequacy decision is a key-mechanism in EU data protection legislation which allows the European Commission to determine whether a third country or an international organisation offers an adequate level of data protection.

In a separate opinion, the EDPB backed a proposed six-month extension of the UK’s current adequacy decisions under the GDPR and Law Enforcement Directive. These decisions were set to expire on 27 June 2025. The Board stressed that this is a temporary and technical extension, needed due to ongoing legislative reforms in the UK. The UK’s data regime is still under revision, and the Commission will assess the final legal framework once adopted.

The EDPB emphasised that further extensions should not be expected and that continued monitoring of UK developments is essential to ensure data protection remains adequate.

These developments matter as they ensure continued legal certainty for international data flows, promote trust, and reinforce global standards for privacy and data protection.