European UnionUnited Kingdom Adequacy Decision, Implementing Decision (EU) 2021/1772 as renewed by Implementing Decision (EU) 2025/2574
Commission Implementing Decision (EU) 2021/1772
In force since .
A cross border transfer rule binding public and private bodies.
- Criminal exposure
- No
- Private right of action
- No
- Obligation class
- Transfer
- Audit expectation
- continuous
- Who audits it
- Regulator
As of .
What it requires
- A transfer of personal data within the scope of Regulation (EU) 2016/679 from the Union to the United Kingdom may take place on the basis of Article 1(1) of the Decision, without any specific authorization (Article 45(1) of Regulation (EU) 2016/679).
Who enforces it
Enforcement body
The competent supervisory authorities of the Member States, which exercise their powers under Article 58 of Regulation (EU) 2016/679 over transfers within the scope of Article 1 and inform the Commission (Article 2), and the Commission, which monitors the application of the legal framework and may suspend, repeal or amend the Decision (Article 3).
What this law does
Article 1(1) of Implementing Decision (EU) 2021/1772 provides that, for the purposes of Article 45 of Regulation (EU) 2016/679, the United Kingdom ensures an adequate level of protection for personal data transferred within the scope of that Regulation from the European Union to the United Kingdom. Article 4 of the original Decision provided that it would expire on , unless extended in accordance with the procedure referred to in Article 93(2) of Regulation (EU) 2016/679.
Implementing Decision (EU) 2025/1226 of replaced Article 4 of the original Decision so that it would expire on , unless extended in accordance with the procedure referred to in Article 93(2) of Regulation (EU) 2016/679.
Implementing Decision (EU) 2025/2574 of records the Commission's conclusion that, on the basis of its assessment of developments including the amendments introduced by the Data (Use and Access) Act, the United Kingdom continues to ensure an adequate level of protection for personal data transferred within the scope of Regulation (EU) 2016/679 from the European Union to the United Kingdom.
Article 4 of the Decision, as replaced by Implementing Decision (EU) 2025/2574, provides that the Decision expires on , unless extended in accordance with the procedure referred to in Article 93(2) of Regulation (EU) 2016/679. Article 1(2) of the original Decision excluded personal data transferred for the purposes of United Kingdom immigration control from the finding. Article 1 of Implementing Decision (EU) 2025/2574 repealed Article 1(2) of the original Decision.
Article 3(1) requires the Commission to monitor continuously the application of the legal framework on which the Decision is based, including the conditions under which onward transfers are carried out, individual rights are exercised and United Kingdom public authorities have access to data transferred on the basis of the Decision.
Article 3(4) provides that, where the Commission has indications that an adequate level of protection is no longer ensured, it informs the competent United Kingdom authorities and may suspend, repeal or amend the Decision. Article 5 provides that the Decision is addressed to the Member States.
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot, sends automated outreach, processes voice recordings or processes biometric data.