European Commission UK Adequacy Assessment Outcome
European Commission UK Adequacy Assessment Outcome
We outline the European Commission’s latest steps to maintain the free flow of personal data between the European Economic Area and the United Kingdom. We explain the background to the new draft adequacy decision, outline the procedure now progressing towards adoption, and consider what this means for organisations transferring personal data into the United Kingdom.
Summary of the European Commission’s adequacy assessment of the United Kingdom
Following its review of the recently adopted UK Data Use and Access Act (DUAA), the European Commission confirmed that the United Kingdom’s data protection legal framework (which includes the DUAA, the UK GDPR and the Data Protection Act 2018) continues to provide safeguards that are essentially equivalent to those offered by the European Union. On 22 July 2025, within a wider package of updates and announcements, the Commission launched the procedure to adopt a new adequacy decision to maintain the free flow of personal data between the European Economic Area and the United Kingdom.
This step effectively grants the United Kingdom a renewal of its adequacy status and means that personal data can continue to flow from the EU to the United Kingdom without the need for additional transfer safeguards. It represents an important and positive development for trade and business relations between the two sides.
Importance of continued data flows
The importance of continued data flows between the UK an EU is clear. The Tech Sovereignty, Security and Democracy department emphasised that data protection is a cornerstone of European Union values, and described the United Kingdom as a key partner.
By maintaining rigorous standards, the Commission reaffirms the commitment to privacy and partnership with the United Kingdom. The recent developments will also help to keep this link open for commerce, research and effective cooperation in criminal justice and law enforcement.
What does this mean for you?
The announcement confirms the Commission’s decision to maintain legal certainty for data transfers between the European Economic Area and the United Kingdom. If your organisation processes personal data across borders, you should ensure your continued compliance with both EU and UK data protection requirements. The renewed adequacy decision provides an updated legal framework to support ongoing digital trade and cooperation, while safeguarding privacy and reinforcing trust between the two jurisdictions.
Next Steps - adoption procedure
The next stages include consideration by a committee composed of representatives of the Member States and scrutiny by the European Parliament before the Commission formally adopts the decision. The multi-stage procedure is designed to ensure transparency and legitimacy for such a significant measure and a final fully approved decision is expected in December 2025.
If you have any queries or would like further information, please visit our data protection services section or contact Christopher Beveridge.