GDPR - Adequacy decisions for the UK

On 28 June 2021, the European Commission adopted two adequacy decisions for the United Kingdom (the "Adequacy Decisions"); the first one concerning the continued free flow of personal data from the European Union (the "EU") to the United Kingdom (the "UK") under the General Data Protection Regulation 2016/679 (the "GDPR") and the other one under the Law Enforcement Directive.

The Adequacy Decisions come just in time to continue the bridging mechanism applicable under the Trade and Cooperation Agreement between the EU and the UK, allowing transfers of personal data from the EU to the UK for a temporary period ending on 30 June 2021.

With the adequacy decision adopted under the GDPR, the Commission confirms that the UK offers an adequate level of protection for personal data. As a consequence, the continued free flow of personal data between the EU and UK is guaranteed at least until 27 June 2025, unless extended. This adequacy decision is the first of its kind having a sunset clause.

For more information, please read our previous article on the topic Draft adequacy decisions for the free flow of personal data from the EU to the UK.