The European Commission has launched the process to adopt new adequacy decisions to allow the free flow of personal data between the European Economic Area and the United Kingdom. Following its assessment of the recently adopted UK Data Use and Access Act, the Commission has concluded that the UK’s legal framework continues to provide data protection safeguards that are essentially equivalent to those provided by the EU.
As part of the adoption procedure, the draft decisions will now be provided to the European Data Protection Board for its opinion. Before adopting the decisions, the Commission will also seek approval from a committee composed of representatives of the EU member states. The European Parliament also has a right of scrutiny over adequacy decisions.
In June 2025, the Commission adopted a technical extension of the two 2021 adequacy decisions for a limited period of six months, which allowed the Commission to conduct an assessment of the UK’s Data Use and Access Act, which received Royal Assent on 19 June 2025. Among other things, the Act provides for new rules on a series of issues including on automated processing of data and the structure of the Information Commissioner. The new draft decisions are based on the assessment of these new rules.
