European Union: Applicability of European Commission’s implementing decision on extension of adequacy decision for the free flow of personal data between EEA and UK ends

On 27 December 2025, the applicability of the European Commission’s implementing decision extending the 2021 adequacy decision for the free flow of personal data between the European Economic Area (EEA) and the United Kingdom ends. An adequacy decision is a legal mechanism under the General Data Protection Regulation (GDPR) that allows personal data to be transferred from the EEA to a third country without requiring additional safeguards, provided that the country ensures an equivalent level of data protection. The original UK adequacy decision was set to expire on 27 June 2025. The Commission adopted a time-limited extension to maintain uninterrupted data flows while the UK finalises the implementation of the Data Protection and Digital Information Bill. Once the legislative process is completed, the Commission will assess the UK’s updated legal framework to determine whether it continues to provide an adequate level of protection. If the assessment is positive, the Commission is expected to adopt a new adequacy decision.