The European Commission has indicated in a draft decision that the UK remains adequate for EU-UK data flows under the new Data (Use and Access) Act 2025 (DUAA). The draft decisions on adequacy relating to the DUAA, in light of the EU GDPR and the Law Enforcement Directive were issued yesterday, and are now subject to an opinion by the European Data Protection Board, a review by the European Parliament and approval by the Member States.

In its assessment of the DUAA, the EU Commission concluded that the UK's legal framework continues to provide data protection safeguards that are essentially equivalent to those provided by the EU.

Michael McGrath, Commissioner for Democracy, Justice, the Rule of Law and Consumer Protection said: “The unobstructed flow of personal data between the EU and the UK is essential for many businesses, public authorities and individuals on both sides of the Channel. With this step, we are ensuring that this vital link stays open - not only to support commerce and research, but also to enable effective cooperation in criminal justice and law enforcement.”

The DUAA, which received Royal Assent on 19 June 2025, amends, but does not replace, the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 (DPA) and the Privacy and Electronic Communications Regulations (PECR).

See:

The draft decisions

Summary of the DUAA provisions

Source: Privacy, Laws & Business