On 19 December 2025, the European Commission reaffirmed that the United Kingdom (UK) ensures an adequate level of data protection so that personal data can continue to be transferred to the UK as third country. The Commission adopted two adequacy decisions: one based on the General Data Protection Regulation (GDPR) and one based on Directive 2016/680 (the "Law Enforcement Directive", LED).

Regarding data transfers for criminal law enforcement purposes, the Commission decision was taken on the basis of Art. 36 LED, which protects personal data that is used by police and criminal justice authorities. This decision permits data transfers from law enforcement authorities of the EU Member States to UK law enforcement authorities without the need for further authorisation.

It follows the Commission's previous adequacy decision, taken in 2021, and an interim extension endorsed in June 2025, as the 2021 adequacy decisions would have expired on 27 June 2025, and the Commission needed time to review the UK's latest legislative reforms by the Data (Use and Access) Act. The renewal also takes into account an opinion by the European Data Protection Board (adopted on 16 October 2025) and comes after the Member States had given green light in the so-called comitology procedure. The adequacy decision is also binding on EU countries with opt-out/opt-in reservations in justice and home affairs (i.e., Ireland and Denmark) and on the Schengen associated countries (Iceland, Norway, Liechtenstein and Switzerland).

The adequacy decision is subject to a "sunset clause", as it will expire on 27 December 2031 unless it is extended. According to the LED, the Commission is obliged to monitor relevant developments in the UK on an ongoing basis in order to assess whether the UK still ensures an essentially equivalent level of protection. This is particularly important given that the UK will apply and enforce a modified data protection regime, with further secondary legislation potentially changing the data protection framework. In addition, a periodic review is required at least four years after the adoption of the adequacy decision. This review must evaluate the functioning of the adequacy decision, including the functioning of the relevant oversight and enforcement mechanisms in the UK.

Likewise, the Commission renewed its adequacy decision under Art. 45 of the GDPR. This ensures that personal data can continue to flow freely and safely between the European Economic Area (EEA) and the UK for the purposes covered by the GDPR. The Commission has clarified that the scope of the renewed adequacy decision now also covers the transfer of personal data for UK immigration control purposes. An "immigration exemption" was included in the 2021 adequacy decision for GDPR-related purposes.

Michael McGrath, Commissioner for Democracy, Justice, the Rule of Law and Consumer Protection, said: "The United Kingdom is an important strategic partner for the European Union and the adequacy decisions form a central pillar of this partnership. By enabling the free flow of personal data, they underpin both commercial exchanges and cooperation in the fields of justice and law enforcement."