The EU’s UK data protection adequacy extension

When businesses transfer personal data outside of the UK, strict legal rules apply under UK data protection laws. The EU also has strict data protection laws regarding the transfer of personal data overseas, as outlined in the EU GDPR. 

The European Commission has proposed extending the UK’s adequacy decision – originally set to expire on June 27, 2025 – by six months, pushing the deadline to December 27, 2025. The extension would allow time to review the UK’s new Data (Use and Access) Bill, also known as the DUA.

A similar extension has been proposed for data transfers under the Law Enforcement Directive, which governs the use of personal data for policing and criminal justice purposes.

This is essential and welcome news for businesses, as it means they can continue to benefit from the free flow of personal data from the EU to the UK, with no need to implement additional safeguards for the time being.

This development also means there is breathing room for the DUA Bill to come into law, following which the EU will review the new legal framework and determine whether it offers adequate protection for personal data.

In the meantime, the DUA Bill is progressing rapidly through parliament, and we are awaiting news on its progress.

Becky White, our data protection solicitor, comments:

This is a welcome development for data flows between the EU and the UK. It means EU businesses can continue sending personal data to the UK without the cost and time required to implement additional safeguards, at least for now. The extension gives the UK valuable time to finalise the DUA Bill, but the big question is whether the EU will still see the UK’s protections as strong enough once the changes come into play. We’ll continue to watch this space for more news, but now is the time for businesses to stay alert and agile to new potential changes in the pipeline that could impact international data transfers.

Your business should monitor these fast-moving developments for further updates, which may impact your operations. If you would like specific guidance on how they could affect your business, you can contact our data protection solicitors.