European Commission Extends UK Data Adequacy Decisions, Securing Free Flow of Personal Information Until 2031
Brussels renews two key data protection agreements with London, ensuring uninterrupted EU-UK transfers under GDPR and law enforcement rules
The European Commission has renewed its two 2021 data adequacy decisions for the United Kingdom, guaranteeing the continued unrestricted flow of personal information between the European Union and the UK until 27 December 2031. Adequacy decisions are legal instruments under EU law that recognise a third country’s data protection framework as offering safeguards essentially equivalent to those in the EU, meaning that organisations can transfer personal data without additional compliance measures.
The decisions being renewed cover transfers under the EU’s General Data Protection Regulation and the Law Enforcement Directive, both of which are crucial for commercial activity, cross-border services and collaboration in justice and policing.
Earlier in 2025, the Commission granted a temporary six-month technical extension to allow time for a full assessment of the UK’s evolving legal framework following the enactment of the Data (Use and Access) Act.
After concluding that the UK’s protections remain closely aligned with EU standards, the Commission adopted the formal renewals, which will remain in force for six years and are subject to periodic review and potential future renewal.
The renewals received support from the European Data Protection Board and Member State representatives during the formal adoption process.
Executive Vice-President for Tech Sovereignty, Security and Democracy Henna Virkkunen stated that preserving adequacy supports seamless data sharing between the European Economic Area and the UK, reducing administrative burdens and bolstering competitiveness.
Commissioners also emphasised the importance of data flows for business, innovation and law enforcement cooperation, noting that the decisions reflect the strategic partnership between the EU and the UK. While adequacy is maintained, the Commission retains the authority to reassess or revoke decisions if the UK’s legal framework diverges materially from EU data protection benchmarks, and the adequacy arrangements will be reviewed after four years to ensure continued alignment.
The decisions being renewed cover transfers under the EU’s General Data Protection Regulation and the Law Enforcement Directive, both of which are crucial for commercial activity, cross-border services and collaboration in justice and policing.
Earlier in 2025, the Commission granted a temporary six-month technical extension to allow time for a full assessment of the UK’s evolving legal framework following the enactment of the Data (Use and Access) Act.
After concluding that the UK’s protections remain closely aligned with EU standards, the Commission adopted the formal renewals, which will remain in force for six years and are subject to periodic review and potential future renewal.
The renewals received support from the European Data Protection Board and Member State representatives during the formal adoption process.
Executive Vice-President for Tech Sovereignty, Security and Democracy Henna Virkkunen stated that preserving adequacy supports seamless data sharing between the European Economic Area and the UK, reducing administrative burdens and bolstering competitiveness.
Commissioners also emphasised the importance of data flows for business, innovation and law enforcement cooperation, noting that the decisions reflect the strategic partnership between the EU and the UK. While adequacy is maintained, the Commission retains the authority to reassess or revoke decisions if the UK’s legal framework diverges materially from EU data protection benchmarks, and the adequacy arrangements will be reviewed after four years to ensure continued alignment.
