European Union: European Commission adopted extension of 2021 adequacy decision for cross-border data flows between the EEA and UK

On 24 June 2025, the European Commission adopted the implementing decision on the extension of the 2021 adequacy decision for the free flow of personal data between the European Economic Area (EEA) and the UK until 27 December 2025. An adequacy decision is a legal mechanism under the General Data Protection Regulation (GDPR) that allows personal data to be transferred from the EEA to a third country without requiring additional safeguards, provided that the country ensures an equivalent level of data protection. The current UK adequacy decision is set to expire on 27 June 2025, and the extension is intended to maintain uninterrupted data flows while the Data Protection and Digital Information Bill is implemented. Once the legislative process concludes, the Commission will assess the UK’s updated legal framework to determine whether it continues to provide an adequate level of data protection. If the assessment is positive, the Commission will propose a new adequacy decision before the 27 December 2025 deadline to allow data transfers to continue without additional compliance requirements.