EU to UK personal data transfer post Brexit update

EU–UK Personal Data Transfers: Where Do We Stand?

The post-Brexit uncertainty over EU–UK data transfers is now resolved. In June 2021, the European Commission granted the UK an adequacy decision under GDPR — meaning personal data can flow freely from the EU/EEA to the UK without the need for Standard Contractual Clauses (SCCs) or other additional safeguards.

That adequacy decision was reviewed and renewed in December 2024, confirming the UK's continued adequacy status. For most organisations, this means EU–UK transfers can continue as normal, provided your privacy documentation reflects the UK as an adequate third country.

However, adequacy is not permanent. It can be reviewed or revoked if the UK's data protection standards diverge materially from the EU framework — something worth monitoring, particularly as the UK explores reforms to its own data protection law.

Bottom line: EU–UK data transfers are lawful under adequacy today, but organisations should keep their records of processing and privacy notices up to date, and stay alert to any future changes in the UK's adequacy status.

Need help reviewing your data transfer arrangements? Contact the Privacy Path team today.