The EU’s UK data protection adequacy decision and why it matters

The EU’s UK data protection adequacy decision and why it matters

On 28 June 2021, the European Union (EU) officially adopted the adequacy decisions allowing data to continue flowing freely to the UK. The UK adequacy decisions were adopted just in time as the six-month bridging period agreed under the UK-EU Trade and Cooperation Agreement expired on 30 June 2021. Following over a year of talks, the EU has formally recognised the UK’s high data protection standards, enabling UK businesses to benefit from unrestricted personal data transfers where they can receive personal data from the EU and European Economic Area (EEA), without needing additional arrangements in place with European data exporters.

Third countries without an adequacy agreement, such as the US, do not enjoy such free flow of personal data with EU member states. Instead, data exporters are forced to take steps to assess each transfer individually to determine if and how they can move data legally. In being granted adequacy, businesses in the UK have dodged disruption to their data transfer practices which is particularly helpful for organisations with a large EU customer base or those heavily reliant on service providers based in EU member states.

The two adequacy decisions, one under the General Data Protection Regulation (GDPR) and the other for the Law Enforcement Directive (LED), highlight the EU’s belief that personal data in the UK 'benefits from an essentially equivalent level of protection to that guaranteed under EU law.'

Both of these adequacy decisions include a sunset clause in the case of future divergence by the UK, limiting the duration of adequacy to four years, after which adequacy might be renewed, but only if the UK continues to ensure an adequate level of data protection. Vêra Jourová, the Vice President of the European Commission for Values and Transparency, emphasised these safeguards when explaining the decision to adopt the adequacy decisions, stating that 'if anything changes on the UK side, we will intervene'.

Commenting on the decision Becky White, our data protection and GDPR expert, stated: 'This means that UK businesses can relax (for now) in the knowledge that they can continue to receive data from the EU without having to change their existing practices and contracts. The EU has confirmed that it will continue to monitor the UK’s data protection regime over the next four years however, and is able to intervene at any point if it believes the UK does not ensure an adequate level of data protection.'

The adequacy decisions are the latest in a series of recent important EU data protection developments, following the European Commission’s decision to adopt new standard contractual clauses (SCCs) for the transfer of personal data for third countries.

Our data protection and GDPR expert

Becky White

Becky White

Senior Data Protection & Privacy Solicitor
Becky is an experienced data protection and privacy lawyer who qualified in 2002. She supports clients with navigating data protection compliance and provides practical commercial advice related to privacy laws.  

Our offices

A national law firm

A national law firm

Our commercial lawyers are based in or close to major cities across the UK, providing expert legal advice to clients both locally and nationally.

We mainly work remotely, so we can work with you wherever you are. But we can arrange face-to-face meeting at our offices or a location of your choosing.

Head Office

Floor 5, Cavendish House, 39-41 Waterloo Street, Birmingham, B2 5PP
Regional Spaces

Stirling House, Cambridge Innovation Park, Denny End Road, Waterbeach, Cambridge, CB25 9QE
13th Floor, Piccadilly Plaza, Manchester, M1 4BT
10 Fitzroy Square, London, W1T 5HP
Harwell Innovation Centre, 173 Curie Avenue, Harwell, Oxfordshire, OX11 0QG
1st Floor, Dearing House, 1 Young St, Sheffield, S1 4UP
White Building Studios, 1-4 Cumberland Place, Southampton, SO15 2NP
A national law firm

To access legal support from just £145 per hour arrange your no-obligation initial consultation to discuss your business requirements.

Make an enquiry