The European Commission renewed the two 2021 adequacy decisions for the free flow of personal data with the United Kingdom. The decisions ensure that personal data can continue flowing freely and safely between the European Economic Area (EEA) and the United Kingdom, as the UK legal framework contains data protection safeguards that are essentially equivalent to those provided by the EU.
In June 2025, the Commission had adopted a technical extension of the 2021 adequacy decisions with the United Kingdom – one under the General Data Protection Regulation and the other concerning the Law Enforcement Directive – for a limited period of six months, as they were set to expire on 27 December this year. This extension allowed the Commission to conduct a thorough assessment of the legal framework in the UK as amended by the Data (Use and Access) Act.
The adoption of the renewal decisions follows the European Data Protection Board's opinion and the Member States' green light in the so-called comitology procedure.
The renewal of our adequacy decisions benefits businesses and citizens alike on both sides of the Channel. It ensures the free flow of personal data between the EEA and the UK in full compliance with data protection rules while reducing costs and administrative burdens. This continuity allows European companies to keep sharing data seamlessly with their UK partners, supporting innovation, competitiveness and trusted digital cooperation, said Henna Virkkunen, Executive VP, Tech Sovereignty, Security and Democracy
"The United Kingdom is an important strategic partner for the European Union and the adequacy decisions form a central pillar of this partnership. By enabling the free flow of personal data, they underpin both commercial exchanges and cooperation in the fields of justice and law enforcement. Their renewal reflects the Commission’s assessment that the United Kingdom’s legal framework continues to provide robust safeguards for personal data that remain closely aligned with EU standards, including in the context of recent legislative developments," said Michael McGrath, Commissioner for Democracy, Justice, the Rule of Law and Consumer Protection
The new decisions are subject to a sunset clause of six years, running until 27th December 2031, with the possibility to be renewed. The Commission together with representatives of the European Data Protection Board will review the functioning of the adequacy decisions after a period of four years.
The European Commission has the competence to determine, on the basis of the General Data Protection Regulation, whether a country or international organisation outside the EU ensures an adequate level of data protection. Following this, the Commission might initiate the process for the adoption of an adequacy decision, which allows the free flow of personal data from the EU and the European Economic Area (EEA) to a third country or international organisation without further obstacles.
Disclaimer – The details expressed in this post are from the companies responsible for sending this post for publication. This website doesn’t endorse the details published here. Readers are urged to use their own discretion while making a decision about using this information in any way. There has been no monetary benefit to the Publisher/Editor/Website Owner for publishing this post and the Website Owner takes no responsibility for the impacts of using this information in any way.