UK granted data protection adequacy decision

After 6 months of waiting, it was confirmed on 28 June 2021 that the EU has granted the UK an adequacy decision for data protection. In fact, there have been 2 adequacy decisions – one under the GDPR, and another in relation to processing under the Law Enforcement Directive.

This means that now the UK has left the EU, personal data can still flow from the EU to the UK without the need for appropriate safeguards (e.g. standard contractual clauses and binding corporate rules under the GDPR) or relying on an exception under Article 49 of the EU GDPR. As the UK also does not require appropriate safeguards for transfers of personal data to the EU then this adequacy decision means that personal data can more easily flow between the UK and EU and will be welcomed by organisations operating in both the UK and EU.

It is important to note that the adequacy decisions granted to the UK, unlike other EU adequacy decisions, have a time limit which is set at 4 years. After those 4 years, the adequacy decision can be renewed but organisations relying on these adequacy decisions for long term transfers of personal data should bear this in mind.

Charlotte Smith is an Associate at Sharpe Pritchard.

For further insight and resources on local government legal issues from Sharpe Pritchard, please visit the SharpeEdge page by clicking on the banner below.

This article is for general awareness only and does not constitute legal or professional advice. The law may have changed since this page was first published. If you would like further advice and assistance in relation to any issue raised in this article, please contact us by telephone or email enquiries@sharpepritchard.co.uk.