EU-UK Adequacy Decision Sunset Clause extended until 27 December 2025
Adequacy Decisions
Since Brexit at 11pm on the 31 January 2020, for the purposes of data protection law, the United Kingdom (“UK”) became a third country. The GDPR restricts the transfer of personal data to third countries unless the rights of the individuals, in respect of their personal data, is protected.
The European Commission issued an adequacy decision with regarding to the UK in June 2021.
Adequacy decisions are formal findings by the European Commission that a third country or international organisation ensures an adequate level of protection for personal data ‘essentially equivalent’ to that within the EU. Once there is an adequacy decision in place, you can continue to transfer data freely to that third country. In the absence of an adequacy decision, you must put in place an alternative transfer mechanism, such as EU model clauses.
The current UK Adequacy Decision
The EU-UK adequacy decision was due to expire this Friday 27 June 2025. On 5 May 2025, the European Data Protection Board (“EDPB”) adopted an opinion on the proposal to extend the validity of the UK adequacy decisions under the GDPR. This opinion only concerns the proposed 6-month extension, and does not assess the level of protection afforded in the UK. This opinion was formally adopted by the Commission on the 24 June 2024, meaning the current adequacy decision in place has now been extended to 27 December 2025. The opinion can be viewed here https://www.edpb.europa.eu/system/files/2025-05/edpb-opinion-202506-uk-adequacyextension-gdpr-led_en.pdf
Data protection law in the UK is currently being updated, with the Data (Use and Access) Bill introduced into the UK parliament in late October 2024. As a result of this development to data protection law in the UK, in its opinion the EDPB recognised the need for technical and time-limited extension of the adequacy decision until 27 December 2025 to allow the pending reform in the UK to conclude.
Commissioner for Democracy, Justice, the Rule of Law, and Consumer Protection, at the European Commission Michael McGrath, said: “The adequacy decisions are key to our relationship with the UK. They ensure data can flow freely and safely, which is crucial for trade, justice, and law enforcement cooperation. Our proposal will allow the Commission to assess whether to renew these decisions based on a stable legal framework, while keeping data flows to the UK uninterrupted.”
What this means for transfers to and from Ireland and the UK?
Transfer of data to the UK can continue as normal however the situation will need to be monitored. The Commission has until 27 December 2025 to adopt a new adequacy decision. Should the European Commission decide not to adopt a new adequacy decision in relation to the United Kingdom at the end of 2025, there will be significant implications. Companies will be required to introduce additional safeguards such as standard contractual clauses or binding corporate rules, meaning transfers from the EU to the UK become more complex and costly.
For companies involved in EU-UK data transfers, this situation should be monitored for changes over the coming months. Once the UK data protection bill becomes law, we anticipate that the EDPB and European Commission will conduct its formal process to review the adequacy of the new legislation, to determine whether or not to issue an updated adequacy decision.
The Commission’s decision to extend the EU-UK adequacy decision can be found here. https://commission.europa.eu/document/a4e20d44-504d-4911-8f11-016fdce79c07_en
For more information please contact our Data Protection Team.
Judith Curtin
jc@ofx.ie
021 4277788
Niamh Carey
nca@ofx.ie
021 4277788