Privacy & Cybersecurity Law Blog

On July 22, 2025, the European Commission announced the launch of the process to adopt new adequacy decisions to allow the free flow of data between the European Economic Area and the UK following the European Commission’s assessment of the recently passed UK Data (Use and Access) Act 2025 (the “DUAA”).

The European Commission has confirmed that, following introduction of the DUAA, the UK maintains data protection safeguards equivalent to those of the EU. In light of the DUAA, the European Commission had previously implemented a technical extension of the two 2021 adequacy decisions in order to facilitate a review of the UK's evolving data legislation. The DUAA introduces several changes to UK data laws, including restructuring the Information Commissioner's Office, revising cookie and tracking technology rules, and easing restrictions on automated decision-making (see further details here).

As part of the process and before adopting new decisions, the European Commission will seek the opinion of the European Data Protection Board and approval of a committee composed of representatives of the EU Member States. The European Parliament also maintains the right of scrutiny over adequacy decisions.