EDPB Approves Six-Month Extension for UK Data Protection Adequacy
The European Data Protection Board (EDPB) has issued an opinion regarding the European Commission’s proposal to extend the UK’s adequacy decisions under the General Data Protection Regulation (GDPR) and the Law Enforcement Directive (LED). These adequacy decisions, which allow for the free flow of personal data from the EU to the UK, are set to expire on June 27, 2025. The opinion specifically addresses a proposed six-month extension of these decisions, without assessing the overall level of data protection in the UK.
The EDPB highlights that the extension is a temporary, technical measure to allow more time for the European Commission to evaluate the UK’s updated data protection framework once it is finalized. The UK’s data protection reform is still under consideration by the UK Parliament, which has delayed the full assessment. The extension would last until December 27, 2025, providing a clear deadline for further review.
This extension is described as exceptional and limited in duration, with the EDPB emphasizing that it should not be extended further. The Board refers back to its previous opinions from April 2021 on the UK adequacy decisions, which remain relevant and should be considered by the European Commission in its ongoing evaluations.
Additionally, the EDPB reminds the European Commission of its duty to monitor all significant developments in the UK’s data protection landscape during the extension period. This continuous oversight is essential to ensure that the UK maintains an adequate level of protection for personal data transferred from the EU.
