EU Initiates Renewal of UK Adequacy Decision Following the UK's Adoption of the Data (Use and Access) Act 2025

EU Launches UK Adequacy Decision Renewal Process
On 22 July 2025, the European Commission announced that it had launched the process to renew the adequacy decision for the United Kingdom (UK) and confirmed that the UK’s updated data protection framework remains closely aligned with European Union (EU) standards. This follows the UK’s adoption of the Data (Use and Access) Act 2025 (DUAA) on 19 June 2025.

What Is an Adequacy Decision?

An adequacy decision enables the free transfer of personal data from the EU to a “third country” where that country’s data protection laws are considered essentially equivalent to those of the EU, eliminating the need for additional safeguards. Since Brexit, the UK has been treated as a “third country” under the EU General Data Protection Regulation (GDPR). This means that, without an adequacy decision, any personal data transferred from the EU to the UK must be protected by additional legal safeguards. However, when an adequacy decision is in place, these extra requirements are not needed, allowing data to flow freely. The original adequacy decision, granted by the European Commission in June 2021, was set to expire in June 2025 but was extended until December 2025 to allow time for assessing the DUAA’s impact.

DUAA’s Impact and the Draft Adequacy Decision

The European Commission’s Draft Adequacy Decision concludes that the amendments introduced by the DUAA to the UK GDPR maintain a regime that is essentially equivalent to the EU’s. This paves the way for the adequacy decision’s renewal, securing uninterrupted data flows for up to six more years.

Next Steps in the Renewal Process

As part of the adequacy renewal process, the European Commission will seek the formal opinion of the European Data Protection Board, which provides expert guidance on data protection matters. While this opinion is non-binding, it plays an important advisory role in shaping the final decision. Subsequently, the decision must be approved by a committee composed of representatives from the EU Member States, who will review and vote on the adequacy proposal. Finally, the European Parliament retains the right to scrutinize the decision, ensuring democratic oversight. Although the Parliament cannot veto the adequacy decision, its scrutiny may influence the process and timing of its final adoption.

What This Means for Businesses

This development provides much-needed reassurance for organizations that process personal data of UK residents and rely on cross-border data sharing, reflecting an ongoing partnership between the EU and the UK in maintaining strong personal data protection.

We will keep you informed of any future developments.