European Union: European Commission adopted implementing decision on further extension of 2021 adequacy decision for free flow of personal data between EEA and UK

On 19 December 2025, the European Commission adopted an implementing decision amending implementing decision (EU) 2021/1772 to confirm the United Kingdom's continued adequacy status for personal data protection. The decision applies to all controllers and processors in the European Union transferring personal data to controllers or processors in the United Kingdom. The Commission found that the United Kingdom's General Data Protection Regulation and Data Protection Act 2018, as amended by the Data (Use and Access) Act 2023 and the Investigatory Powers (Amendment) Act 2024, continue to provide equivalent protection to that guaranteed by the European Union's General Data Protection Regulation (Regulation 2016/679). The assessment covered oversight mechanisms, including the Information Commissioner's Office, the Investigatory Powers Commissioner, and the Investigatory Powers Tribunal, finding evidence of active enforcement and complaint handling. The decision notes new provisions under Part 7A of the Investigatory Powers Act 2016 for bulk personal datasets with low privacy expectations, whilst the existing warrant regime remains for sensitive datasets. The decision entered into force on 19 December 2025 and will apply until 27 December 2031, unless extended.