Skip to main content


The end of the chapter:

The United Kingdom is finally considered as “adequate”

July 2nd, 2021

We are happy to share some very good news. A month ago, we informed you that the Commission should decide whether to adopt an adequacy decision for the UK. This has been done, which means that the EU recognized the United Kingdom’s data protection law as adequate. The free movement of personal data transfers, as part of the EU-UK Trade and Cooperation Agreement can continue without further action being required.

UK GDPR = Essentially equivalent

As the UK GDPR is based on EU law, the UK data protection rules closely mirror in many respects the corresponding rules applicable within the European Union” and are therefore “essentially equivalent.”

However, we should be cautious, the UK is considering starting negotiations on the development of the UK’s data protection policy. “The Government plans to promote the free flow of personal data globally and across borders, including through ambitious new trade agreements and new data adequacy agreements with some of the fastest growing economies, while ensuring that people’s data continues to be protected to high standards.” As a precaution, the EU is using a four-year ‘sunset clause’, it is the first time that the EU uses this clause.

The EU’s official statement contains an explicit warning to the UK:

“For the first time, the adequacy decisions include a so-called ‘sunset clause', which strictly limits their duration. This means that the decisions will automatically expire four years after their entry into force. After that period, the adequacy findings might be renewed, however, only if the UK continues to ensure an adequate level of data protection. During these four years, the Commission will continue to monitor the legal situation in the UK and could intervene at any point, if the UK deviates from the level of protection currently in place. Should the Commission decide to renew the adequacy finding, the adoption process would start again.”

Press release, European Commission

We hope that the adequacy decision can persuade UK policy makers to avoid a radical departure from EU privacy law in order to preserve legal certainty. The decision was particularly welcomed by businesses as data transfers have become an essential part of international trade.

“This breakthrough in the EU-UK adequacy decision will be welcomed by businesses across the country. "

John Foster, director of policy for the Confederation of British Industry

In the future,

In the future, we can envisage the possibility of a Schrems III ruling on the UK data adequacy agreement, Max Schrems replied that he had not examined the UK surveillance law in detail and did not currently foresee a legal challenge. However, the Commission found that the principles of proportionality and limited access to personal data are respected in the UK legislation. As mentioned in the title, this is the end of the chapter but not the end of the book.

Victoria MyData-TRUST

Victoria Derumier

Data Protection Manager at MyData-TRUST

If you want to contact us

Contact us