EU UK Adequacy Decision

On 18 March, 2025, the European Commission (the “Commission") announced its proposal for a six-month extension to the UK’s data adequacy decisions. The extension is currently under review by the European Data Protection Board (“EDPB”) and, if approved, will push the expiration date for both decisions from June 27, 2025, to December 27, 2025. This extension will ensure the continued free flow of personal data between the EU and the UK while the Commission carries out a full review of the UK’s data protection framework. 

The original adequacy decisions, granted in 2021, confirmed that the UK’s data protection laws provide a level of security equivalent to EU standards, allowing data to move freely without additional safeguards. Without an extension, businesses and organisations handling cross-border data transfers would be faced with legal uncertainty and the potential need to adopt alternative transfer mechanisms. 

Crucially, the extension will allow time for the UK’s legislative process regarding data protection reforms to conclude. The UK government has been proposing changes to its data protection regime for some time now, and the extension will enable the Commission to assess the final form of any legislative amendments before approving any longer term adequacy decisions. 

The Commission officials emphasised the importance of maintaining data flows, stressing that this plays a key role in trade, justice and law enforcement cooperation between the EU and the UK. 

If the EDPB delivers a positive opinion, the extension offers a valuable transition period for businesses and public sector organisations to prepare for any potential regulatory changes that may result from the Commission’s review. It also reinforces the importance of ongoing dialogue between the UK and EU authorities to ensure long-term stability in data-sharing arrangements. 

Companies involved in EU-UK data transfers should continue to monitor these developments and seek legal advice, where required, to ensure compliance with any future changes. 

For further information please contact Data Protection Partners Zelda Deasy, Seán O'Donnell, Jane O'Grady or any member of the Byrne Wallace Shields LLP Data Protection/GDPR Team.