The European Commission has confirmed the renewal of the two UK data adequacy decisions (our 2021 article here), ensuring the continued free flow of personal data from the EEA to the UK under both the GDPR and the Law Enforcement Directive. It is an expected outcome (following an extension to the process in June 2025 to take into account the UK's Data (Use and Access) Act), but nonetheless a welcome and stabilising development for "trans-Channel" data ecosystems as we head into 2026.
The new EU decisions will expire on 27 December 2031 unless extended, and remain the only adequacy decisions with such a "sunset" clause.
Practically, this means EU-to-UK transfers can continue without the need for Standard Contractual Clauses or other Article 46 transfer tools. For most organisations, existing data export architectures, vendor contracting, and record-keeping can remain unchanged. However, adequacy is not a "set and forget" status. The Commission will continue to monitor legal developments in the UK and retains powers to amend, suspend, or revoke adequacy if essential equivalence were to erode over the next 5-6 years. That said, given the Commission's own recent proposals for simplification of GDPR (Has the EU been "Sic In Omnibus"? Or do all roads lead to a new world of Data and AI EU deregulation?) contains seeming inspiration from certain UK liberalisations, at this moment in time it seems a renewal in 2031 would be the most likely outcome as well (certainly for the GDPR adequacy decision).
A few takeaways for privacy, security and commercial teams: First, adequacy materially reduces transfer friction and cost, especially in complex outsourcing chains. Second, it de-risks deal timelines for EU–UK projects that hinge on cross-border processing. Third, it does not replace other obligations: transparency, purpose limitation, DPA diligence, security controls, and DPIAs still apply; onward transfers from the UK to third countries remain subject to UK transfer rules.
But for now, in short, the renewal brings regulatory certainty at a critical juncture, allowing businesses and public bodies to focus on delivery rather than redocumenting data flows. A sensible decision, and a timely gift, for both economies.
Henna Virkkunen, Executive Vice-President for Tech Sovereignty, Security and Democracy, said:
"The renewal of our adequacy decisions benefits businesses and citizens alike on both sides of the Channel. It ensures the free flow of personal data between the EEA and the UK in full compliance with data protection rules while reducing costs and administrative burdens. This continuity allows European companies to keep sharing data seamlessly with their UK partners, supporting innovation, competitiveness and trusted digital cooperation."
UK Minister for Digital Government and Data, Ian Murray, said:
"I'm thrilled to welcome the EU's renewal of its two adequacy decisions for the UK. We remain committed to enabling secure, trusted data flows between the UK and EU to support growth, innovation and security."
