Autumn Data Wrap: A Snapshot Of Key Regulatory Developments

In June 2021, the European Commission adopted two adequacy decisions (the "Adequacy Decisions") for the UK (under the EU GDPR and the Law Enforcement Directive). The Adequacy Decisions grant the UK adequate protection status, enabling the flow of personal data from the EU to the UK without additional safeguards. They are due to expire on 27 December 2025.

The European Commission has now issued two new draft decisions proposing to extend the UK's adequacy status until December 2031 and noting that the UK's data protection standards continue to be "essentially equivalent" to the EU's data protection standards.

Since publication of the proposed new decisions, the European Data Protection Board ("EDPB") has issued its opinion on the proposed renewal. The EDPB signalled general approval and welcomed the "continuing alignment between the UK and EU data protection framework". However, the EDPB noted areas of the UK data protection framework that should be