Data Transfers to the United Kingdom: The Commission Renews Its Adequacy Decision

On 19 December 2025, the European Commission renewed its adequacy decision relating to the transfer of personal data to the United Kingdom. (1)

This decision means that the UK data protection framework provides a level of protection for personal data that is essentially equivalent to that afforded by the GDPR. As a result, organisations may continue to transfer personal data to the United Kingdom without additional safeguards or constraints.

As a reminder, one of the consequences of Brexit was to call into question the free flow of personal data to the United Kingdom, as the country was no longer subject to the GDPR. The UK nevertheless adopted legislation (known as UK GDPR) that is largely aligned with the GDPR. (2)

An initial adequacy decision was swiftly adopted by the European Commission on 28 June 2021. That first decision, initially valid until 27 June 2025, had to be extended by six months, until 27 December 2025, in order to allow time for the adoption of the new adequacy decision.

This decision is accompanied by a second adequacy decision adopted under the “Law Enforcement” Directive. (3)

(1) Commission Implementing Decision of 19.12.2025

(2) UK GDPR

(3) Directive (EU) 2016/680 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data


Bénédicte DELEPORTE
Avocat

Deleporte Wentz Avocat
www.dwavocat.com

January 2026