The European Commission (the Commission) has adopted a six-month extension of the two adequacy decisions with the United Kingdom, allowing continuation of the free flow of data with the UK until 27 December 2025. The extension was proposed back in March 2025 to give time to the UK to finalise the now adopted Data (Use and Access) Act. The adoption of the six-month technical extension follows a positive opinion by the European Data Protection Board in May, and approval by the Member States on 2 June – discussed here: EDPB approves temporary extension of UK adequacy decisions.

What are adequacy decisions?

Adequacy decisions are a mechanism under EU data protection law that permit the transfer of personal data to third countries or international organisations that provide an equivalent level of protection. The UK was granted adequacy status following Brexit, ensuring continued data flows between the EU and UK. 

What next?

The Commission is now assessing whether the new UK legal framework continues to provide an adequate level of protection for personal data. On the basis of this assessment, the Commission will decide whether to renew the UK adequacy decisions. In the meantime, the key safeguards in the UK legal framework that were found adequate in 2021 remain in place and continue to apply to data transferred from the EU.

Executive Vice-President for Tech Sovereignty, Security and Democracy, Henna Virkkunen, said: “The EU and UK are among the most digitally connected markets globally. Keeping data flowing smoothly is vital to maintain our partnership. Today's extension allows the data to continue to flow freely to the UK, while we assess whether on the basis of its new law, the adequacy decisions can be renewed on a more permanent basis.”

We will continue to monitor the Commission’s stance on EU-UK data flow.