The EU Commission has renewed adequacy decisions for the free flow of personal data with the United Kingdom, ensuring personal data can continue flowing between the European Economic Area and the UK.
The decision confirms the EU executive conclusion that the UK legal framework contains data protection safeguards that are essentially equivalent to those provided by the EU.
“The renewal of our adequacy decisions benefits businesses and citizens alike on both sides of the Channel,” said EC executive vice-president Henna Virkkunen: “It ensures the free flow of personal data between the EEA and the UK in full compliance with data protection rules while reducing costs and administrative burdens.”
In June 2025, the Commission had adopted a technical extension of the 2021 adequacy decisions with the United Kingdom – one under the General Data Protection Regulation and the other concerning the Law Enforcement Directive – for a limited period of six months, as they were set to expire on 27 December this year. This extension allowed the Commission to conduct a thorough assessment of the legal framework in the UK as amended by the Data (Use and Access) Act.
The adoption of the renewal decisions follows the European Data Protection Board’s opinion and the Member States’ green light in the so-called comitology procedure.
The new decisions are subject to a sunset clause of six years, running until 27 December 2031, with the possibility to be renewed. The Commission together with representatives of the European Data Protection Board will review the functioning of the adequacy decisions after a period of four years.
Data protection adequacy for non-EU countries
