Written by: Haim Ravia, Dotan Hammer
The European Data Protection Board (EDPB) has adopted opinions on the European Commission’s draft decisions to extend the UK’s data protection adequacy under both the GDPR and the Law Enforcement Directive (LED) until December 2031. The current adequacy decisions are set to expire next month.
The extension is crucial because it allows organizations and law enforcement authorities in the European Union to continue transferring data to their UK counterparts without the need to implement additional safeguards.
Key Points from the UK GDPR adequacy opinion
- The EDPB notes that most changes made to the UK’s data protection framework are consistent with the GDPR.
- The UK’s Secretary of State has been granted new powers to introduce changes to data protection rules via secondary regulations, which require a lower degree of parliamentary scrutiny, particularly in areas like international transfers, automated decision-making, and the governance of the UK’s privacy regulator, the Information Commissioner’s Office (ICO).
- The new international transfer adequacy test in the UK, introduced by the Data (Use and Access) Act 2025, only requires the protection level of the third country to be “not materially lower” than that provided by the UK framework. This test does not specifically address the risk of government access, the availability of redress for individuals, or the necessity ofr an independent supervisory authority.
- The UK’s Technical Capability Notices (TCNs) require UK telecommunications operators to build or maintain the technical ability to provide assistance to UK law enforcement and intelligence agencies for lawful data access. The EDPB highlights the UK Government’s use of TCNs due to the risk they pose to the integrity and confidentiality of electronic communications.
- The EDPB calls for the assessment and monitoring of changes to the structure of the ICO and the exercise of its corrective powers.
The new adequacy decisions will supplement the 2021 decisions, which will continue to apply to areas not covered by the 2025 decisions.
Click here to read the European Data Protection Board’s Opinion 26/2025 regarding the European Commission Draft Implementing Decision pursuant to Regulation (EU) 2016/679 on the adequate protection of personal data by the United Kingdom.
Click here to read the European Data Protection Board’s Opinion 27/2025 regarding the European Commission Draft Implementing Decision pursuant to Directive (EU) 2016/680 on the adequate protection of personal data by the United Kingdom.
