The European Commission (the Commission) has proposed extending two ‘adequacy’ decisions that facilitate the free flow of personal data between the EU and the UK. On 1 April 2025, the Commission came forward with a draft Implementing Decision (for which the text is not yet publicly available) to amend Commission Implementing Decision (EU) 2021/1772 under Regulation (EU) 2016/679. This draft seeks to extend the current adequacy arrangements by a further six months. The current adequacy decision, originally adopted in 2021 following the UK’s exit from the EU, is set to expire on 27 June 2025. If the extension is approved, the transfer of personal data between the EU and the UK would be permitted through to December 2025.
What is an EU adequacy decision?
An adequacy decision is a formal recognition that another territory’s data protection regime offers a level of protection essentially equivalent to that of the EU. In this case, the 2021 adequacy decision between the EU and the UK has enabled personal data to flow freely while remaining compliant with both the EU General Data Protection Regulation (GDPR) and the EU Law Enforcement Directive.
The process for adopting an adequacy decision includes:
- a proposal by the European Commission;
- an opinion issued by the European Data Protection Board;
- approval from EU member state representatives; and
- final adoption by the European Commission.
Once adopted, implementing legislation is often used to address technical aspects of the legislation.
| Implementing decisions are legally binding instruments that apply directly to all EU Member States. They are designed to ensure the consistent and uniform application of EU law. These decisions can only be adopted when the underlying EU legislation explicitly authorises their use, and their scope is strictly limited to what is necessary for effective implementation. |
Why is the extension needed — and why only six months?
The current EU-UK adequacy decisions are set to expire on 27 June 2025. If they are not extended, organisations transferring personal data between the EU and the UK would face significantly higher compliance costs due to the stricter data protection requirements.
The proposed extension is intended as a temporary measure, as the UK is in the process of reforming its data protection regime through the proposed UK Data (Use and Access) Bill. This legislation aims to revise elements of the UK GDPR, with the goal of reducing regulatory burdens. The Bill was introduced in Parliament in autumn 2024 and is currently at the committee report stage in the House of Commons.
Once the UK’s legislative process is complete, the Commission will evaluate the updated UK data protection framework. A decision on whether to propose a longer-term adequacy arrangement will depend on whether the revised UK framework continues to offer an adequate level of protection for personal data.
The Commission’s proposed six-month extension is therefore intended to allow time for the UK to finalise its reforms and for the EU to carry out a thorough assessment of the new legal landscape.
Understanding the UK Data (Use and Access) Bill
The current Labour Government introduced the UK Data (Use and Access) Bill in the House of Lords in October 2024. The Bill is now progressing through the House of Commons before moving on to final scrutiny and, if passed, Royal Assent. It proposes a number of reforms to the existing data protection framework, which are likely to signal a shift in data management policies and require UK organisations to adapt their compliance frameworks and operational procedures accordingly. Detail of the Bill can be found in its explanatory notes.
The Bill sets out three key objectives:
As data protection is a reserved matter, the proposed amendments to the Data Protection Act 2018 and the UK GDPR would apply in Northern Ireland. However, certain aspects — such as provisions related to ‘Part 1: Access to Customer Data and Business Data’ — fall within devolved competence and therefore there would be an expectation of a Legislative Consent Motion (LCM) from the respective devolved administrations. An LCM is a constitutional convention (not legally binding) that allows the UK Parliament to legislate on devolved matters with the consent of a devolved legislature.
Annex A of the Bill’s explanatory notes provides detailed information on the Bill’s territorial scope. While the Scottish Parliament has passed an LCM, Northern Ireland has not yet considered one, and no timeline has been indicated for when such a motion might be introduced in the Assembly.
Could the UK reforms undermine its longer-term adequacy status?
A key aim of the Bill is to support data-driven innovation and improve efficiency within the UK economy. The proposed reforms address several important areas, including data subject rights, the regulation of artificial intelligence, automated decision-making, and the processing of personal data for scientific research. However, significant divergence from EU standards in these domains could jeopardise the UK’s adequacy status.
Concerns had been heightened during the passage of the former Government’s Data Protection and Digital Information Bill (DPDI Bill). In contrast, the current Data (Use and Access) Bill is not currently viewed as posing the same level of risk to the UK’s adequacy status. However, the full extent of any potential divergence will only become clear once the Bill completes its passage through Parliament.
Commenting on the proposed extension, EU Commissioner for Democracy, Justice, the Rule of Law, and Consumer Protection, Michael McGrath, stated:
The adequacy decisions are key to our relationship with the UK. They ensure data can flow freely and safely, which is crucial for trade, justice, and law enforcement cooperation. Our proposal will allow the Commission to assess whether to renew these decisions based on a stable legal framework, while keeping data flows to the UK uninterrupted.
If the UK’s framework is no longer deemed equivalent, the EU could revoke adequacy status — requiring UK–EU data transfers to rely on alternative legal mechanisms such as Standard Contractual Clauses, increasing costs and legal complexity for businesses.
Impact on Northern Ireland
One of the challenges following the UK’s departure from the EU has been the risk of divergence in data protection standards, with particular implications for businesses, services, and organisations in Northern Ireland that depend on the free flow of personal data across the border with Ireland and other EU Member States.
In October 2024, the House of Lords European Affairs Committee published its inquiry findings on UK-EU data adequacy. The findings highlighted concerns raised by the Northern Ireland Human Rights Commission (NIHRC), the Equality Commission for Northern Ireland (ECNI), and the Centre for Cross Border Studies (CCBS). Their inquiry submissions warned that any loss of the UK’s adequacy status could seriously impact both North-South and East-West cooperation, affecting individuals and institutions. The NIHRC and ECNI also stressed that data protection rights form part of the fundamental rights protected under the Belfast/Good Friday Agreement, and that a loss of adequacy could breach the ‘no diminution of rights’ commitment set out in Article 2 of the Windsor Framework.
Although much of the inquiry’s evidence focused on the previous Government’s DPDI Bill, the Committee noted that with the UK’s adequacy decision due for review in June 2025, the findings remain highly relevant. Any loss of adequacy could have wide-ranging implications for cross-border cooperation and key sectors across Northern Ireland.
Next steps in the EU decision-making process
Once the text becomes available, the draft Implementing Decision will be published on the EU’s ‘Have Your Say’ portal, where it will be open for public consultation over a four-week period. Feedback received during this time will be compiled and submitted to the relevant comitology committee, which will then vote on the draft implementing act.
| ‘Comitology’ refers to a loosely structured system of around 250 committees, each organised by thematic area and composed of representatives from EU Member States. These committees play a critical role in ensuring that the European Commission does not act unilaterally when adopting implementing acts, as their approval is required. |
Since this draft measure follows the EU’s ‘examination procedure’ for implementing acts, as set out in the Lisbon Treaty, the committee must issue either a positive or negative opinion by a qualified majority. A qualified majority in favour leads to the adoption of the proposed act; a qualified majority against blocks its adoption.
If the committee issues a negative opinion, the Commission has two options: it can revise the draft and resubmit it to the committee, or escalate it to the Appeal Committee, which is made up of the deputy permanent representatives of the Member States. Adoption through the Appeal Committee follows the same rules as the examination procedure.
Therefore, whilst the six-month extension would provide short-term continuity for cross-border data flows, the longer-term outlook hinges on whether the UK’s final legal framework maintains sufficient alignment with EU standards. For now, all eyes will be on both Westminster’s legislative process and the EU’s formal adequacy assessment that follows.
Assembly Library on Twitter
Northern Ireland Assembly on Facebook