European Union: European Commission issued draft implementing decision on adequate protection of personal data by United Kingdom

On 22 July 2025, the European Commission (EC) published a draft decision on the adequate protection of personal data in the United Kingdom (UK) (Commission Implementing Decision pursuant to Article 45(3) of Regulation (EU) 2016/679 to renew and amend Commission Implementing Decision (EU) 2021/1772). This follows a previous decision, which temporarily extended the previous adequacy decision by six months (until 27 December 2025), to allow the EC to complete its adequacy assessment in light of the UK Data (Use and Access) Act, which received Royal Assent on 19 June 2025. The draft decision evaluates relevant legal, institutional and operational changes in the UK since 2021, including amendments to the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018), including the introduction of new lawful bases under Article 6(1)(ea) and Annex 1, the restructuring of further processing conditions under Article 8A and Annex 2, and revisions to automated decision-making rules under Articles 22A to 22D, among others. It further addresses the implementation of safeguards required under Article 23(2) UK GDPR in relation to the immigration exemption, and the UK’s updated international transfer framework, including adequacy regulations for the Republic of Korea and certified United States (US) organisations under the UK extension to the European Union–United States Data Privacy Framework (EU–US DPF). The draft proposes removing the previous exclusion of immigration-related data transfers and confirms that the UK continues to ensure an adequate level of protection for personal data transferred from the European Union (EU).