The European Commission has renewed the two 2021 adequacy decisions under which the UK’s legal framework for data protection is recognised as meeting standards essentially equivalent to those provided by the EU.

The 2021 adequacy decisions were originally set to expire on 27 June 2025, which the Commission had already extended to 27 December 2025.

The new decisions are subject to a sunset clause of six years, running until 27 December 2031, with the possibility to be renewed.

The Commission, together with representatives of the European Data Protection Board (EDPB), will review the functioning of the adequacy decisions after a period of four years.

Henna Virkkunen, the Commission’s executive vice-president for tech sovereignty, security and democracy, said: “The renewal of our adequacy decisions benefits businesses and citizens alike on both sides of the Channel.

“It ensures the free flow of personal data between the EEA and the UK in full compliance with data protection rules while reducing costs and administrative burdens.

“This continuity allows European companies to keep sharing data seamlessly with their UK partners, supporting innovation, competitiveness and trusted digital cooperation.”

Michael McGrath, commissioner for democracy, justice, the rule of law and consumer protection, said: “The United Kingdom is an important strategic partner for the European Union and the adequacy decisions form a central pillar of this partnership.

“By enabling the free flow of personal data, they underpin both commercial exchanges and cooperation in the fields of justice and law enforcement.

“Their renewal reflects the Commission’s assessment that the United Kingdom’s legal framework continues to provide robust safeguards for personal data that remain closely aligned with EU standards, including in the context of recent legislative developments.”