Opinion 06/2025 regarding the extension of the European Commission Implementing Decisions under the GDPR and the LED on the adequate protection of personal data in the United Kingdom

Adopted 1 Opinion 06 /2025 regarding the extension of the European Commission Implementing Decisions under the GDPR and the LED on the adequate protection of personal data in the United Kingdom Adopted on 5 May 2025 Adopted 2 The European Data Protection Board Having regard to Article 70(1)(s) of the Regulation 2016/679/EU of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and re pealing Directive 95/46/EC (hereinafter “GDPR”), Having regard to Article 51(1)(g) of the Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA (hereinafter “Law Enforcement Directive”), Having regard to the European Economic Area Agreement (EEA) and in particular to Annex XI and Protocol 37 thereof, as amended by the Decision of the EEA joint Committee No 154/2018 of 6 July 2018 1 , Having regard to Article 12 and Article 22 of its Rules of Procedure, HAS ADOPTED THE FOLLOWING OPINION: 1. On 28 June 2021, the European Commission adopted two adequacy decisions for the United Kingdom of Great Britain and Northern Ireland ( “ UK ” ) , one under the General Data Protection Regulation (“GDPR”) 2 , the other under the Law Enforcement Directive (“LED”) 3 (hereinafter referred to together as “decisions”). Both decisions include a sunset clause and are set to expire on 27 June 2025, unless renewed. The sunset clauses were introduced into the decisions as the UK data protection legal framework was expected to evolve, thereby creating the need for the legal framework to be re - assessed by the European Commission . The European Data Protection Board (“EDPB”) issued Opinion 14/2021 4 and Opinion 15/2021 5 on the draft adequacy decisions pursuant to the GDPR and the LED respectively. 2. On 23 October 2024, the UK government introduced a Data (Use and Access) ( “ DUA ” ) Bill which proposes to amend certain elements of UK data protection law. The DUA Bill is currently before the UK Parliament and the legislative process is not expected to conclude before late spring. 1 References to “Member States” made throughout this opinion should be understood as references to “EEA Member States”. 2 Commission Implementing Decision (EU) 2021/1772 of 28 June 2021 pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council on the adequate protection of personal data by the United Kingdom 3 Commission Implementing Decision (EU) 2021/1773 of 28 June 2021 pursuant to Directive (EU) 2016/680 of the European Parliament and of the Council on the adequate protection of personal data by the United Kingdom. 4 Opinion 14/2021 regarding the European Commission Draft Implementing Decision pursuant to Regulation (EU) 2016/679 on the adequate protection of personal data in the United Kingdom https://www.edpb.europa.eu/system/files/2021 - 04/edpb_opinion142021_ukadequacy_gdpr.pdf_en.pdf 5 Opinion 15/2021 regarding the European Commission Draft Implementing Decision pursuant to Directive (EU) 2016/680 on the adequate protection of personal data in the United Kingdom https://www.edpb.europa.eu/system/files/2021 - 04/edpb_opinion152021_ukadequacy_led_en.pdf Adopted 3 3. As the assessment on essential equivalence of UK law must be based on a stable legal framework, the European Commission proposed a technical and time - limited extension of the decisions for a period of six months, i.e. until 27 December 2025 . This i s permitted by Articles 4 of both decisions specifying that the expiration would occur on 27 June 2025 “ unless extended in accordance with the procedure referred to in Article 93(2) of Regulation (EU) 2016/679 ”. According to the European Commission, this extension would allow the UK legislative process to conclude . In the meantime, the UK data protection framework found adequate in the 2021 decisions would remain in place. Consequently , data transferred from the EEA would continue to benefit from an adequate level of protection during the extended validity period . 4. On March 18, 2025, the European Commission published its draft implementing decisions amending (i) Commission Implementing Decision (EU) 2021/1772 of 28 June 2021 pursuant to the GDPR and (ii) Commission Implementing Decision (EU) 2021/1773 of 28 June 2021 pursuant to the LED on the protection of personal data by the UK. On the same date, the European Commission requested the EDPB’s opinion on both draft Implementing Decisions . Given that both of them aim to extend the validity of the current decisions, the EDPB finds it appropriate to address them in a single opinion. 5. The present EDPB opinion only concerns the proposed 6 - month extension of the Commission Implementing Decisions . It does not assess the level of protection afforded in the UK, which will be examined by the EDPB once the Commission has concluded its assessment and if new draft adequacy decisions have been proposed . 6. T he EDPB clarifies that this Opinion is neither revisiting the EDPB opinions issued in 2021, nor does it have any impact on the EDPB’s assessment of any future draft adequacy decisions on the UK. T he views expressed in Opinions 14/2021 and 15/2021 remain valid and the EDPB invites the E uropean Commission to take them into account in its future assessments . 7. At the date of this Opinion, according to the European Commission , the UK data protection framework has not been impacted by major changes , whereas the ongoing legislative process will result in modifications of the legal framework , which would not be taken into account if the adequacy assessment were to be conducted before the original expiration dates of the decisions. 8. In light of the above, the EDPB recognises the necessity of the technical and time - limited extension of the decisions for a period of six months, as it will give the Commission the necessary time to assess the updated UK legal framework once it has been adopted. The EDPB understands that this exte nsion is exceptional and caused by the ongoing legislative process in the UK and that it should not, in principle, be further prolonged. 9. Finally, the EDPB recalls the European Commission’s obligation to closely monitor all relevant developments in the UK that may have an impact on the essential equivalence of the level of protection of personal data during this extension period, and to take swift appropriate actions, where necessary.