(AGENPARL) - Roma, 20 Ottobre 2025(AGENPARL) – Mon 20 October 2025 Draft UK adequacy decisions: EDPB adopts opinions
Brussels, 20 October – During its latest plenary, the EDPB adopted two opinions on the European Commission’s draft decisions on the extension of the validity of the UK adequacy decisions under the General Data Protection Regulation (GDPR) and the Law Enforcement Directive (LED) until December 2031.*
The EDPB opinions, requested by the Commission as per Art. 70(1) (s) GDPR and Art. 51(1) (g) LED, address the proposed six-year extension of the two UK adequacy decisions which are set to expire in December 2025.
The extension of the validity of the UK adequacy decisions will allow organisations and competent authorities based in Europe to continue transferring data to UK-based organisations and authorities without implementing additional guarantees.**
“The EDPB welcomes the continuing alignment between the UK and Europe’s data protection framework, despite the recent changes in the UK legal framework.
I call on the European Commission to address the points highlighted by the Board and to ensure an effective monitoring once the decisions are adopted. This will increase the robustness of UK’s adequacy and ensure more legal certainty for organisations and competent authorities transferring personal data from Europe to the UK.”
EDPB Chair, Anu Talus
About the GDPR opinion
According to the Board, most of the changes introduced to the UK’s data protection framework aim to clarify and facilitate compliance with the law.
Some aspects of the draft decision could be further clarified.
The EDPB invites the European Commission to further analyse and monitor the changes to the Retained EU Law (Revocation and Reform) Act 2023, also known as REUL Act, in particular the removal of the principle of primacy of EU law and the removal of the direct application of the principles of EU law.
The EDPB notes that the Secretary of State has been granted new powers to introduce changes to the new data protection framework, via secondary regulations which require less Parliamentary scrutiny. This is the case for international transfers, automated decision-making, and the governance of the Information Commissioner’s Office (ICO). The EDPB invites the Commission to address possible risks of divergence by highlighting, in the final adequacy decision, the areas which they intend to carefully monitor.
The EDPB also encourages the Commission to further elaborate its assessment and monitor the rules on transfers from the UK to third countries. The new adequacy test, introduced by the Data (Use and Access) Act 2025, requires the level of protection of the third country to be not materially lower than the one provided for data subjects by the UK framework, but this test does not refer to the risk of government access, the existence of redress for individuals and the need for an independent supervisory authority.
The Commission should also further assess and monitor the purported use by the UK Government of Technical Capability Notices (“TCN”) requiring companies to circumvent encryption, as this would create systemic vulnerabilities and pose a risk to the integrity and confidentiality of electronic communications.
Finally, the EDPB calls on the Commission to further assess and monitor the changes to the structure of the ICO and the exercise of its corrective powers. In this context, the EDPB positively notes the transparency policy of the ICO and the availability of the statistical and analytical data of its enforcement activities.
About the LED opinion
The EDPB welcomes the continuous alignment between the data protection framework in Europe and the UK, and encourages the Commission to complement its assessment on aspects relating to national security exemptions. Such exemptions may waive most data protection principles and some international transfer rules for law enforcement authorities, and also limit ICO’s enforcement and inspection powers.
The EDPB invites the Commission to analyse the UK’s rules on transfers of personal data to third countries, in particular the new adequacy test, in the same way as in the GDPR opinion.
The Board also points out the more permissive approach for automated decision making and the new powers conferred to the Secretary of State in this matter. It recalls the importance of meaningful human review and urges the Commission to clarify and monitor possible exemptions from individuals’ right to obtain human intervention.
Finally, the EDPB acknowledges that the system of oversight of criminal law enforcement agencies as well as the redress mechanisms remain largely unchanged, and it reiterates the need for the Commission to closely monitor the application of corrective powers and remedies for individuals in the UK data protection framework.
Note to editors:
* On 22 July 2025, the European Commission issued two draft amending implementing decisions on the adequate protection of personal data by the United Kingdom pursuant to Article 45(3) GDPR and Article 36(3) LED. These draft decisions aim at extending the validity of the previous adequacy decisions adopted on 28 June 2021.
In May 2025, the Commission adopted a decision to extend the validity of the UK adequacy decision for six more months, from June until December 2025. The EDPB adopted an opinion on this extension in May 2025.
** An adequacy decision is a key-mechanism in EU data protection legislation which allows the European Commission to determine whether a third country or an international organisation offers an adequate level of data protection. The European Commission has the power to determine, on the basis of Art. 45 of Regulation (EU) 2016/679 whether a country outside the EU offers an adequate level of data protection.
The adoption of an adequacy decision involves: 1) a proposal from the European Commission; 2) an opinion of the European Data Protection Board; 3) an approval from representatives of EU countries; 4) the adoption of the decision by the European Commission.
