EU Commission: the adequacy decision for the transfer of personal data to the United Kingdom renewed for a further six years.

The European Commission has renewed the two 2021 adequacy decisions enabling the free flow of personal data with the United Kingdom. These decisions ensure that personal data can continue to flow freely and securely between the European Economic Area (EEA) and the United Kingdom, as the UK legal framework provides data protection safeguards that are essentially equivalent to those afforded under EU law.

In June 2025, the Commission had adopted a technical extension of the 2021 adequacy decisions with the United Kingdom—one under the General Data Protection Regulation and the other concerning the Law Enforcement Directive—for a limited period of six months, as their expiry was scheduled for 27 December of this year. This extension allowed the Commission to carry out an in-depth assessment of the UK legal framework, as amended by the Data (Use and Access) Act.

The adoption of the renewal decisions follows the opinion of the European Data Protection Board and the approval of the Member States under the so-called comitology procedure.

The renewed decisions are subject to a six-year sunset clause, running until 27 December 2031, with the possibility of renewal. The European Commission, together with representatives of the European Data Protection Board, will review the functioning of the adequacy decisions after a period of four years.

Under the General Data Protection Regulation, the European Commission is empowered to determine whether a third country or an international organisation outside the EU ensures an adequate level of data protection. Where this is the case, the Commission may initiate the process for the adoption of an adequacy decision allowing the free flow of personal data from the EU and the European Economic Area (EEA) to that third country or international organisation without additional safeguards or barriers.