EU offers UK early gift: Data adequacy until 2031

Relief for those dealing with data pipelines between the two, but move has its critics

The EU has extended its adequacy decision, allowing data sharing with and from the UK under the General Data Protection Regulation for at least six more years.

This will be some relief to techies in the UK and the member state block and beyond whose work or product set depends on the frictionless movement of data between the two, especially as they can point to the 2031 expiration date as a risk managing aspect to backers and partners. But the move does have its critics.

After GDPR was more-or-less replicated in UK law following the nation's official departure from the EU, the trading and political bloc made its first adequacy decision to allow sharing with a specific jurisdiction outside its boundaries.

In a statement last week, the European Commission — the executive branch of the EU — said that it was renewing the 2021 decision to allow the free flow of personal data with the United Kingdom. "The decisions ensure that personal data can continue flowing freely and safely between the European Economic Area (EEA) and the United Kingdom, as the UK legal framework contains data protection safeguards that are essentially equivalent to those provided by the EU," it said.

In June 2025, the Commission had adopted a technical extension of the 2021 adequacy decisions with the United Kingdom – one under the GDPR and the other concerning the Law Enforcement Directive – for a limited period of six months, as they were set to expire on 27 December this year.

The renewal decisions will last for six years until 27 December 2031 and will be reviewed after four years. It followed the European Data Protection Board's opinion and the Member States' approval.

Following the UK's departure from the EU, the Conservative government originally made plans to diverge from EU data protection law, potentially jeopardizing the adequacy decision. In 2022, for example, then digital minister Michelle Donelan said that the UK planned to "seize this post-Brexit opportunity fully, and unleash the full growth potential of British business," claiming: "We can be the bridge across the Atlantic and operate as the world's data hub."

These proposals never made it into law. Since the election of a Labour government, Parliament has passed the Data Use and Access Act.

The government promised the new data regime would boost the British economy by £10 billion over the next decade by cutting NHS and police bureaucracy, speeding up roadworks, and turbocharging innovation in tech and science.

The Act also offers a lawful basis for relying on people’s personal information to make significant automated decisions about them, as long as data processors apply certain safeguards.

None of this has been enough to upset the EU, it seems. ®