EDPB issues Opinions on EU Commission’s UK draft adequacy decisions



The European Data Protection Board (EDPB) has published mostly positive opinions on the UK’s draft GDPR adequacy decisions published in July 2025, saying that it welcomes the continuing alignment between the UK and EU data protection frameworks.

The EDPB says that ‘most of the changes introduced to the UK’s data protection framework aim to clarify and facilitate compliance with the law’. However, it says that the European Commission should seek further clarifications on some aspects of the draft decision.

“I call on the European Commission to address the points highlighted by the Board and to ensure an effective monitoring once the decisions are adopted. This will increase the robustness of UK’s adequacy and ensure more legal certainty for organisations and competent authorities transferring personal data from Europe to the UK,” EDPB Chair, Anu Talus said.

The examples the EDPB mentions include data transfers from the UK to third countries, and the changes to the Retained EU Law (Revocation and Reform) Act 2023, also known as REUL Act - in particular the removal of the principle of primacy of EU law and the removal of the direct application of the principles of EU law.

The EDPB says that with regard to data transfers from the UK to third countries, the new Data (Use and Access) Act 2025 requires the level of protection of the third country to be not materially lower than the one provided by the UK law. However, this test does not refer to the risk of government access, the existence of redress for individuals and the need for an independent supervisory authority, the EU DPAs say.

The EDPB calls on the Commission to further assess and monitor the changes to the ICO’s structure.

The UK’s adequacy decision will expire on 27 December 2025, unless extended by the proposed six years until December 2031.

See: