The European Commission has adopted renewed adequacy decisions for the UK under the GDPR and the Law Enforcement Directive, following a review that took account of the Data (Use and Access) Act 2025.
What this means
- Personal data can continue to flow freely from the EU and EEA to the UK without additional safeguards.
- The decisions are valid for six years, until December 2031, with a review after four years.
- The Commission will continue to monitor UK developments.
This is welcome certainty for UK organisations with EU customers, employees or suppliers. It remains good practice to keep transfer mechanisms under review, especially for onward transfers from the UK to third countries.
Source: Commission renews UK adequacy decisions (European Commission)
This update is general information, not legal advice. If you would like help assessing the impact on your information security or privacy programme, contact us.
