The European Commission has today adopted two adequacy decisions for the UK, one under the GDPR and one under the Law Enforcement Directive.
This means personal data can continue to flow freely from the EU and EEA to the UK without the need for additional safeguards such as Standard Contractual Clauses.
Points to note
- The decisions include a sunset clause and will expire after four years unless renewed.
- The Commission will monitor developments in UK law closely, and can suspend or amend the decisions if UK protections diverge significantly.
- Transfers for UK immigration control purposes are excluded.
This is welcome news for UK organisations serving EU customers and using EU-based data, but it is worth keeping fallback transfer arrangements under review.
Source: Commission Implementing Decision (EU) 2021/1772 (EUR-Lex)
This update is general information, not legal advice. If you would like help assessing the impact on your information security or privacy programme, contact us.
