Businesses that transfer data to and from Europe will be delighted to hear that the European Commission has given a green light for continued data flows. On 28 June 2021, the European Commission published its final General Data Protection Regulation (GDPR) and Law Enforcement Directive (LED) adequacy decisions in favour of the UK. This means that businesses and organisations in the UK who transfer data to and from Europe (whether that be to a group company, a payroll provider or an IT services provider) can do so, freely, without having to put in place an alternative safeguard mechanism – such as using Standard Contractual Clauses or Binding Corporate Rules.
With just two days to go until the official deadline of 30 June, these adequacy decisions mean that personal data can now flow freely from the European Union to the United Kingdom, as the European Commission has agreed that UK data protection law offers an ‘essentially equivalent’ level of protection to that guaranteed under EU law. The adequacy decisions also facilitate the correct implementation of the EU-UK Trade and Cooperation Agreement, which foresees the exchange of personal information, for example for cooperation on judicial matters.
However, there should be a degree of caution as both adequacy decisions include a "sunset clause", which limits the duration of the decisions. Therefore, the adequacy decisions will automatically expire four years after they enter into force (i.e. they will expire on 27 June 2025). After this period, the adequacy findings will require to be renewed, but only if the UK continues to ensure an adequate level of data protection. The European Commission has indicated that it will closely monitor the legal position in the UK during this four year period and may suspend, repeal or amend the adequacy decisions, for example if UK law deviates from the level of data protection currently in place. This is being seen as a warning shot to the UK Government to carefully consider any reforms that may be being planned for UK data protection law and practice in a post-Brexit UK.
These decisions will bring a great deal of relief to businesses, many of whom had effectively put their data transfer decisions on hold pending the outcome of European Commission’s adequacy decision. It means that businesses can now proceed with a degree of certainty and avoid (at least for the time being) another round of re-papering of data transfer contracts.
Please get in touch if you require advice on your international data transfers.
Written by
Related News, Insights & Events
Data and the digital economy: Managing risk and making the most of opportunities
30/09/2025 - Edinburgh
Data is everywhere – and the ways in which we’re collecting, processing and utilising it are constantly evolving, while regulation and governance best practice struggles to keep up.
Data protection complaints set to surge: Are you prepared?
26/08/2025
The recently enacted Data (Use and Access) Act 2025 introduces some important changes to existing UK data protection laws.
A guide to the ECCTA ID verification process
31/07/2025
A step-by-step guide to verify your identity online to comply with the identity verification (IDV) regime introduced by the Economic Crime and Corporate Transparency Act 2023 (ECCTA).
