Personal data can continue to flow freely from the EU to the UK. On 19 December 2025 the European Commission renewed the UK’s two adequacy decisions, which had been due to expire on 27 December 2025. The renewed decisions run until 27 December 2031.
This article was first published in October 2025, when renewal was still pending. It was updated in October 2026 to reflect the outcome.
What are EU-UK data adequacy decisions?
An adequacy decision is a finding by the European Commission that a country outside the EU protects personal data to a standard essentially equivalent to EU GDPR. When a country has one, organisations in the EU can send personal data there without extra safeguards such as Standard Contractual Clauses (SCCs) or Binding Corporate Rules (BCRs).
The UK has two adequacy decisions, both first adopted in June 2021 after Brexit:
- one under the GDPR, covering commercial and general transfers
- one under the Law Enforcement Directive, covering transfers for law enforcement purposes
In practice this means, for example, that a French company can use a UK-hosted cloud service, or a German subsidiary can send customer data to its UK parent, without putting a transfer contract in place first.
Timeline
- June 2021: the Commission adopts the original decisions for four years.
- 19 June 2025: the Data (Use and Access) Act 2025 (DUAA) receives Royal Assent, making changes to UK GDPR, the Data Protection Act 2018 and PECR.
- June 2025: the original decisions are extended by six months, to 27 December 2025, so that the Commission can assess the DUAA.
- October 2025: the European Data Protection Board (EDPB) gives its opinion on the draft renewal.
- 19 December 2025: the Commission renews both decisions until 27 December 2031.
- 5 February 2026: most of the DUAA’s data protection changes come into force in the UK.
Why the Commission reviewed the DUAA
The Commission had to check that the DUAA’s changes did not reduce UK protection below the EU standard. The areas it looked at included:
- automated decision-making: the DUAA allows decisions based solely on automated processing in wider circumstances, subject to safeguards
- recognised legitimate interests: a new lawful basis for a fixed list of purposes, such as crime prevention and safeguarding, without the usual balancing test (see our article on recognised legitimate interests)
- scientific research: broader rules on using personal data for research, including commercial research
- onward transfers: the DUAA replaced the UK’s test for international transfers with a new “data protection test”, which asks whether protection in the destination is not materially lower than in the UK
- the regulator: the ICO’s independence and enforcement powers, including the DUAA’s change from a single Information Commissioner to an Information Commission run by a board, which took effect on 30 September 2026
The Commission concluded that UK law continues to provide an essentially equivalent level of protection.
What the renewal means for organisations
For EU organisations sending personal data to the UK, nothing changes. Transfers can continue without SCCs or other transfer tools until at least December 2031.
For UK organisations sending personal data to the EU and EEA, nothing changes either. That direction is governed by UK law, which already treats the EU and EEA as providing adequate protection.
Adequacy is not permanent. The decisions remain under review, and the Commission can suspend, amend or withdraw them if UK law moves away from the EU standard. Future UK reforms, court rulings on UK surveillance law, or a challenge before the Court of Justice of the EU could all lead to a reassessment before 2031.
What to check now
No urgent action is needed, but it is worth keeping the following up to date so you could respond quickly if adequacy were ever withdrawn.
Record your EU-UK transfers. Your record of processing should show:
- what data you transfer, and in what volume
- which EU countries it comes from and which UK entities or systems receive it
- why you transfer it, and the lawful basis
- which suppliers and processors are involved in each country
Know your fallback options. If adequacy were withdrawn, EU-to-UK transfers would need another mechanism:
- Standard Contractual Clauses: Commission-approved contract terms between the EU sender and UK recipient, usually with a transfer impact assessment.
- Binding Corporate Rules: approved internal rules for transfers within a corporate group. These take time to get approved.
- Derogations: limited exceptions such as explicit consent or necessity for a contract, which cannot be used for routine, repeated transfers.
Keep contracts in view. Note which agreements with EU customers, suppliers and group companies rely on adequacy, so you know which would need amending.
Check your onward transfers. If you send data received from the EU on to other countries, such as the US, make sure those transfers meet UK rules, including the DUAA’s data protection test. Our article on the ICO’s international transfer guidance covers this.
Brief the relevant teams. Legal, procurement and data protection staff should know that adequacy has been renewed, when it next expires, and what would need to happen if it changed.
Summary
The European Commission renewed the UK’s adequacy decisions on 19 December 2025, after reviewing the Data (Use and Access) Act. EU-UK data flows can continue without additional safeguards until 27 December 2031. The decisions remain subject to review, so organisations should keep their transfer records current and know which fallback mechanisms they would use if the position changed.
