On 28 June 2021, the European Commission adopted adequacy decisions for the UK under the General Data Protection Regulation. The decisions mean personal data can continue to flow freely from the European Union to the UK without the need for businesses to put additional arrangements in place.

Points to note include:

• The adequacy decisions are based on the UK’s current standards for data protection and include strong safeguards in case of future divergence.
• They include a ‘sunset clause’ which limits their duration and means they will automatically expire after four years. After this period, the adequacy decisions may be renewed (subject to a new adoption process) but only if the UK continues to adhere to the same level of protection currently in place.
• Data transfers for the purposes of UK immigration control are excluded. The Commission will reassess the exclusion once the situation has been remedied under UK law.