Printable version

UK granted data adequacy by the European Commission

The decision granting the UK data adequacy is welcomed by techUK members for whom maintaining interrupted data flows is a key concern emerging from the UK’s departure from the EU.

On 19 February 2021, the European Commission launched the process towards adopting two adequacy decisions after having assessed the UK’s data protection regime as providing an equivalent level of protection to the EU General Data Protection Regulation (GDPR) and the Law Enforcement Directive. These decisions, if adopted by the European Council, will grant the UK ‘data adequacy’ permitting the continued free flow of personal data between the European Economic Area (EEA) and the UK.

Under the EU GDPR transfers of personal data to non-EU/EEA countries are not automatically allowed, requiring an additional legal basis. Data adequacy decisions provide such a legal basis and are granted to countries which demonstrate an equivalent level of data protection to the EU GDPR.

Personal data was still able to be exchanged freely between the UK and the EU during the transition period between 31 January 2020 and 31 December. The EU-UK Trade & Cooperation Agreement (TCA) signed on 24 December 2020 included a bridging mechanism up until June 2021 to extend this as there was insufficient time for the European Commission to complete its data adequacy assessment before the end of the transition period.

The decision will now be scrutinised by the European Data Protection Board which will give an opinion on the Commission's assessment. After the opinion is given, the decision will progress to comitology before a final decision is taken by the European Council.

If the adequacy decisions are adopted, companies based in the UK that want to continue transferring data from the EU to the UK will not need to put in place an additional legal basis, such as Standard Contractual Clauses (SCCs), to transfer personal data with the EEA. The adequacy decision will be reviewed after four years.

Since the day after the 2016 EU referendum, techUK members with bases in the UK and the EU have advocated for the continued free flow of data between the UK and the EU as one of their core priorities.

According to a report by the New Economics Foundation and the UCL European Institute, the additional compliance obligations resulting from not receiving data adequacy could have cost the UK economy up to £1.6 billion.

The decision by the European Commission that the UK is adequate is significant for both the UK and EU tech sectors which raised a combined $41bn in investment in 2020 and are at heart of  the post-COVID 19 economic recovery plans. Combined with the non-discrimination and data flows provisions within the UK-EU TCA, this decision will enable UK and EU technology companies to access the maximum benefits from the new UK-EU trading relationship.

Commenting on the data adequacy decisions, techUK CEO Julian David said:

The European Commission decision that the UK’s data protection regime offers an equivalent level of protection to the EU GDPR is a vote of confidence in the UK’s high data protection standards. Today's decisions are warmly welcomed by the tech sector which has been making clear the importance of a mutual data adequacy agreement since the day after the referendum. Receiving data adequacy, alongside the EU-UK Trade and Cooperation Agreement, will set a solid foundation for digital trade with the EU, including strong non-discrimination clauses and positive data flows provisions, that will give businesses the confidence to invest. As we go forward, the UK must also complete the development of its own international data transfer regime, allowing UK companies not just to exchange data with the EU, but also to be able to access global opportunities.
Channel website:

Original article link:

Share this article

Latest News from

Close the gaps in Microsoft N365 with a Defence in Depth Strategy