The European Commission has launched the process to adopt new adequacy decisions to allow the free flow of personal data between the European Economic Area and the United Kingdom.
Following assessment of the recently adopted UK Data Use and Access Act, the Commission has concluded that the UK’s legal framework continues to provide data protection safeguards that are essentially equivalent to those provided by the EU.
“Data protection is a cornerstone of EU values,” said EC vice-president Henna Virkkunen: “And the United Kingdom a key partner. By upholding rigorous standards, we ensure trust in digital cooperation – and this decision reaffirms our commitment to both privacy and our continued partnership with the UK.”
“The unobstructed flow of personal data between the EU and the UK is essential for many businesses, public authorities and individuals on both sides of the Channel,” added EC Commissioner Michael McGrath: “With this step, we are ensuring that this vital link stays open – not only to support commerce and research, but also to enable effective cooperation in criminal justice and law enforcement.”
As part of the adoption procedure, the draft decisions will now be transmitted to the European Data Protection Board for its opinion. Before adopting the decisions, the EU executive will also seek approval from a committee composed of representatives of the EU Member States. The European Parliament also has a right of scrutiny over adequacy decisions.
The Commission adopted a technical extension of the two 2021 adequacy decisions in June 2025 for a limited period of six months, which allowed the EU executive to conduct an assessment of the UK’s Data Use and Access Act, which received Royal assent on 19 June 2025.
The Act provides for new rules on a series of issues including on automated processing of data and the structure of the UK’s data protection authority. The new draft decisions are based on the assessment of these new rules. More information on adequacy decisions can be found online.
