The extension of the EU-UK adequacy decision to allow the free flow of personal data between the European Economic Area and the UK has received the green light from the European Commission. In a statement, it said that following its assessment of the UK Data Use and Access Act, it had started the process to adopt new adequacy decisions after concluding that the UK’s legal framework continued to provide data protection safeguards that were essentially equivalent to those provided by the EU. The extension must also be approved by the European Data Protection Board, EU member states, and could be subject to review by the European Parliament.
Commission starts process to maintain free and safe data flows between EU and the UK
Today, the European Commission launched the process to adopt new adequacy decisions to allow the free flow of personal data between the European Economic Area and the United Kingdom. Following its assessment of the recently adopted UK Data Use and Access Act, the Commission has concluded that the UK's legal framework continues to provide data protection safeguards that are essentially equivalent to those provided by the EU.
Henna Virkkunen, Executive Vice-President for Tech Sovereignty, Security and Democracy, said: “Data protection is a cornerstone of EU values. And the United Kingdom a key partner. By upholding rigorous standards, we ensure trust in digital cooperation—and this decision reaffirms our commitment to both privacy and our continued partnership with the UK.”
Michael McGrath, Commissioner for Democracy, Justice, the Rule of Law and Consumer Protection, added: “The unobstructed flow of personal data between the EU and the UK is essential for many businesses, public authorities and individuals on both sides of the Channel. With this step, we are ensuring that this vital link stays open - not only to support commerce and research, but also to enable effective cooperation in criminal justice and law enforcement.”
As part of the adoption procedure, the draft decisions will now be transmitted to the European Data Protection Board for its opinion. Before adopting the decisions, the Commission will also seek approval from a committee composed of representatives of the EU Member States. The European Parliament also has a right of scrutiny over adequacy decisions.
In June 2025, the Commission adopted a technical extension of the two 2021 adequacy decisions for a limited period of six months, which allowed the Commission to conduct an assessment of the UK's Data Use and Access Act, which received Royal assent on 19 June 2025. The Act provides for new rules on a series of issues including on automated processing of data and the structure of the UK's data protection authority. The new draft decisions are based on the assessment of these new rules. More information on adequacy decisions can be found online.
Sources:
Write a comment