The European Data Protection Board (EDPB) has adopted an opinion on the European Commission’s proposal to extend the validity of the UK adequacy decisions under the GDPR and the Law Enforcement Directive (LED). The current adequacy decisions, which allow the free flow of personal data between the EU and the UK, are set to expire on June 27, 2025. The proposed extension would grant an additional six months to maintain data transfers while the UK undergoes legislative changes.

The EDPB Chair said: “The EDPB welcomes the Commission’s initiative to work on the first adequacy decision concerning an international organisation. This decision shows how the legal framework of such organisations can be recognised as ensuring an adequate level of protection on the basis of Art.45 GDPR. The EDPB underlines the importance of ongoing dialogue between the Commission and  international organisations, with a view to developing this category of adequacy decisions in addition to those relating to third countries.”

What are adequacy decisions?

Adequacy decisions are a mechanism under EU data protection law that permit the transfer of personal data to third countries or international organisations that provide an equivalent level of protection. The UK was granted adequacy status following Brexit, ensuring continued data flows between the EU and UK. 

EDPB’s position

The EDPB acknowledged that the extension is exceptional and caused by the ongoing legislative process in the UK (being the pending Data (Use and Access) Bill which proposes amendments to data protection regulations). The EDPB emphasised that the extension should not exceed the necessary timeframe and that the European Commission will closely monitor developments in UK data protection law. 

The extension in validity period allows the continued free flow of personal data from the EU to the UK until 27 December 2025. This will give the European Commission sufficient time to evaluate the updated UK legal framework once it has been adopted.