European Union: European Commission's implementing decision on further extension of 2021 adequacy decision for free flow of personal data between EEA and UK ends

On 27 December 2031, the European Commission's implementing decision amending implementing decision (EU) 2021/1772 to confirm the United Kingdom's continued adequacy status for personal data protection ends. The decision applied to all controllers and processors in the European Union transferring personal data to controllers or processors in the United Kingdom. The Commission found that the United Kingdom's General Data Protection Regulation and Data Protection Act 2018, as amended by the Data (Use and Access) Act 2023 and the Investigatory Powers (Amendment) Act 2024, continued to provide equivalent protection to that guaranteed by European Union's Regulation 2016/679. The assessment covered oversight mechanisms including the Information Commissioner's Office, the Investigatory Powers Commissioner, and the Investigatory Powers Tribunal, finding evidence of active enforcement and complaint handling.