Privacy & Cybersecurity Law Blog

On December 19, 2025, the European Commission announced the renewal of the two UK adequacy decisions originally adopted in 2021, reaffirming that personal data may continue to move freely between the European Economic Area and the UK. This renewal confirms the European Commission’s latest assessment that the UK’s legal framework continues to provide data protection safeguards that are essentially equivalent to those in the EU, specifically following recent legislative changes introduced by the UK Data (Use and Access) Act 2025. The decision follows the European Commission’s implementation of a technical extension of the adequacy decisions in June 2025. For more background, read our previous blog post.

The European Commission’s position follows the recent opinion issued by the European Data Protection Board (“EDPB”) and approval from the EU Member States.

The renewed adequacy decisions are each subject to a term of six years, set to expire on December 27, 2031. However, there is potential for further renewal, subject to subsequent assessments. Importantly, the European Commission has committed to a mid-point review of the decisions after four years, working closely with the EDPB to evaluate ongoing adequacy.