On 22 July 2025, the European Commission proposed draft decisions to extend the United Kingdom’s GDPR adequacy status until December 2031. This would allow EU organisations to continue transferring personal data to the UK without additional safeguards such as Standard Contractual Clauses.
The European Data Protection Board (EDPB) has now issued its opinion, welcoming the proposal but urging the Commission to monitor the UK’s evolving legal framework. Key concerns include the effects of the Retained EU Law Act 2023, expanded ministerial powers to amend data rules, national security exemptions, and risks linked to encryption and international transfers.
The next step is for the European Commission to formally adopt the UK adequacy extension.
Click here to read the EDPB:s press release.
