Brussels extends data flows of personal data with the UK

The European Commission has renewed two adequacy decisions for the free flow of personal data with the United Kingdom.

As of January 1st, 2021, the United Kingdom is officially no longer part of the European Union (EU). Since then, the UK is no longer obligated to comply with European laws and regulations, such as the General Data Protection Regulation (GDPR).

However, it’s in the UK’s best interest to commit to European privacy rules. Failure to do so would make it virtually impossible for British companies to do business with mainland Europe.

For that reason, the UK copied several privacy laws in April 2021, including the GDPR. At the same time, the European Commission issued two adequacy decisions to authorize the transfer of personal data from Europe to the UK.

An adequacy decision is a decision in which Brussels has determined that a country has an adequate level of protection for personal and sensitive data. This means that companies operating in the EU are allowed to transfer personal data to the UK without restrictions.

In June 2025, the European Commission had adopted a technical extension of the 2021 adequacy decisions with the United Kingdom for six months. This extension gave the Commission the time it needed to conduct an assessment of the legal framework in the UK, as commissioned by the Data Act.

The renewed adequacy decisions will run for six years, until December 27th, 2031. By then, they will have to be renewed. Four years from now, the European Commission and the European Data Protection Board (EDPB) will review the functioning of the adequacy decisions.

“The renewal of our adequacy decisions benefits businesses and citizens alike on both sides of the Channel. It ensures the free flow of personal data between the EEA and the UK in full compliance with data protection rules while reducing costs and administrative burdens,” Executive Vice-President for Tech Sovereignty, Security and Democracy Henna Virkkunen says in a statement.

“This continuity allows European companies to keep sharing data seamlessly with their UK partners, supporting innovation, competitiveness, and trusted digital cooperation,” she continues.

“The United Kingdom is an important strategic partner for the European Union, and the adequacy decisions form a central pillar of this partnership. By enabling the free flow of personal data, they underpin both commercial exchanges and cooperation in the fields of justice and law enforcement,” Michael McGrath, Commissioner for Democracy, Justice, the Rule of Law and Consumer Protection, adds.