Privacy & Cybersecurity Law Blog

On March 18, 2025, the European Commission proposed to adopt an extension of the two adequacy decisions with the UK for a period of six months. The adequacy decisions permit the transfer of data subject to the EU General Data Protection Regulation and to the EU Law Enforcement Directive to the UK without restriction. The adequacy decisions were each granted for a period of four years, expiring on June 27, 2025, unless extended. The extensions have been proposed to allow the UK time to finalize the legislative process regarding the draft Data (Use and Access) Bill. Once finalized, the European Commission will assess whether the UK continues to provide an adequate level of protection for personal data under the new regime. If that assessment is positive, the European Commission will propose to renew the UK adequacy decisions.

The draft extension decisions will now be transmitted to the European Data Protection Board for its opinion, as part of the adoption procedure. Once approved, the extension will be valid until December 27, 2025.