European Union: European Commission proposed extension on 2021 adequacy decision for cross-border data flows between the EEA and UK

On 18 March 2025, the European Commission proposed an extension of the 2021 adequacy decision for the free flow of personal data between the European Economic Area (EEA) and the UK until 27 December 2025. An adequacy decision is a legal mechanism under the General Data Protection Regulation (GDPR) that allows personal data to be transferred from the EEA to a third country without requiring additional safeguards, provided that the country ensures an equivalent level of data protection. The current UK adequacy decision is set to expire on 27 June 2025, and the extension is intended to maintain uninterrupted data flows while the UK completes its legislative process on the Data Protection and Digital Information Bill, introduced in Parliament on 23 October 2024. Once the legislative process concludes, the Commission will assess the UK’s updated legal framework to determine whether it continues to provide an adequate level of data protection. If the assessment is positive, the Commission will propose a new adequacy decision before the 27 December 2025 deadline to allow data transfers to continue without additional compliance requirements.