On March 18, 2025, the European Commission proposed to extend its adequacy decision in favor of the United Kingdom (‘UK’) for an additional six-month period. This would allow free flows of personal data from the EU to the UK to continue until December 2025. The existing adequacy decision – which was adopted in 2021 in light of the UK’s departure from the European Union – is currently due to expire on June 27, 2025.
The proposed extension comes as the UK approaches the final stages of passing legislation to reform its data protection framework. The UK Data (Use and Access) Bill aims to amend aspects of the UK GDPR, in some cases with the objective of reducing regulatory burdens for organizations falling within its scope.
Once that legislative process concludes, the European Commission will assess the new UK framework, and may propose to renew the UK adequacy decision if it considers that the UK continues to provide an adequate level of protection for personal data.
The draft extension decision will now be transmitted to the European Data Protection Board for its opinion. If approved, the extension will be valid until 27 December 2025.
The draft implementing decision can be found here.
