European Commission to adopt new UK adequacy decisions

The European Commission has announced the launch of the process to adopt new adequacy decisions to allow the free flow of data between the European Economic Area and the UK following the European Commission’s assessment of the Data (Use and Access) Act 2025 (DUAA) which received Royal assent on 19 June 2025.

In its assessment of the DUAA, the Commission concluded that the UK's legal framework continues to provide data protection safeguards that are essentially equivalent to those provided by the EU. The DUAA provides for new rules on a series of issues including on automated processing of data and the structure of the UK's data protection authority. The new draft decisions are based on the assessment of these new rules. 

Henna Virkkunen, Executive Vice-President for Tech Sovereignty, Security and Democracy, said: “Data protection is a cornerstone of EU values. And the United Kingdom a key partner. By upholding rigorous standards, we ensure trust in digital cooperation - and this decision reaffirms our commitment to both privacy and our continued partnership with the UK.”

Michael McGrath, Commissioner for Democracy, Justice, the Rule of Law and Consumer Protection, added: “The unobstructed flow of personal data between the EU and the UK is essential for many businesses, public authorities and individuals on both sides of the Channel. With this step, we are ensuring that this vital link stays open - not only to support commerce and research, but also to enable effective cooperation in criminal justice and law enforcement.”

What are adequacy decisions?

Adequacy decisions are a mechanism under EU data protection law that permit the transfer of personal data to third countries or international organisations that provide an equivalent level of protection. The UK was granted adequacy status following Brexit, ensuring continued data flows between the EU and UK. 

What’s next?

As part of the adoption procedure, the draft decisions will now be transmitted to the European Data Protection Board for its opinion. Before adopting the decisions, the Commission will also seek approval from a committee composed of representatives of the EU Member States. The European Parliament also has a right of scrutiny over adequacy decisions.