The European Commission (EC) has proposed to extend the UK’s two adequacy decisions by six months, allowing the free flow of personal data from the EU to the UK without additional safeguards. Adequacy was granted by the EC, post Brexit, in June 2021 with sunset clauses limiting their time to four years before requiring review.
An adequacy decision is a determination by the EC that a nation has equivalent data protection regulations. The following adequacy decisions were granted to the UK, and would expire on 27 June 2025:
- EU GDPR Adequacy Decision: This decision allows personal data to be transferred from the EU to the UK under the GDPR. It deems the UK’s data protection standards as equivalent to those of the EU for personal data processing.
- Law Enforcement Directive (LED): This separate directive under Art 36 of Directive (EU) 2016/680 covers data exchanges in the law enforcement sector, deeming the UK to be a competent authority for the purposes of processing personal data.
Both are fundamental for allowing data flows between the EU and the UK.
Read our previous blogpost on the matter here.
This comes as the UK seeks to update its data protection legislation. The previous Data Protection and Digital Information Bill did not pass last July due to national elections. The bill has been revived as the Data (Use and Access) (DUA) Bill, proposed in the UK Parliament on 23 October 2024, which the UK Parliament seeks to pass this year. The EC will need to reassess the UK’s data protection regulations if and when the DUA Bill passes, to decide whether to renew the UK’s adequacy past the end of this year.
Read our previous blogpost on the Data Use and Access Bill here.
To allow for the DUA Bill to pass and to allow time for the EC to assess whether the new legislation aligns with the EU regulatory framework, an extension of six months has been proposed by the EC. The EU Commissioner for Democracy, Justice, the Rule of Law, and Consumer Protection, Michael McGrath, said: “The adequacy decisions are key to our relationship with the UK. They ensure data can flow freely and safely, which is crucial for trade, justice, and law enforcement cooperation. Our proposal will allow the Commission to assess whether to renew these decisions based on a stable legal framework, while keeping data flows to the UK uninterrupted.”
The proposed extension will now be considered by the European Data Protection Board (EDPB), which has until the current expiration date of the adequacy decisions (27 June 2025) to come to a conclusion. If approved, the UK would retain its adequacy until 27 December 2025.
What this means for UK and EU organisations
The proposed extension of the UK adequacy decisions by the EC has significant implications for organisations who operate between the EU and UK. For UK businesses, the extension, if approved, will allow them to continue transferring personal data from the EU without additional legal safeguards. This is particularly important for sectors like finance, healthcare, and technology, where seamless data flows are essential for operations and compliance. Without the adequacy decision, UK organisations would need to put in place additional data protection protections increasing compliance costs and administrative burden.
EU based organisations must nevertheless stay vigilant and monitor developments in the UK’s data protection legislation, particularly the DUA Bill, to ensure ongoing compliance and prepare for any changes that might affect data transfer agreements.
Overall, the extension of the adequacy decisions would support continued collaboration and data exchange between the UK and the EU. Both UK and EU organisations should therefore take proactive steps to strengthen their data protection measures and stay informed about legislative changes to mitigate risks and ensure compliance in the future.
Read the European Commission’s full press release here.
Please contact Jose Saras and Xavier Prida for detailed advice on the above.
The material in this article is only for general review of the topics covered and does not constitute legal advice. No legal or business decision should be based on its content.
This article is written in English language. Preiskel & Co LLP is not responsible for any translation of all or part of its content into any language.