As you may recall from our article here, as the EU’s adequacy decision permitting data transfers from the EU to the UK creeped towards expiry, there was some concern that the UK’s new Data (Use and Access) Act 2025 would undermine the UK’s adequacy status.
But never fear! Employers transferring personal data from the EU to the UK will be relieved to hear that on 19 December 2025, the European Union extended its adequacy decision for the transfer of personal data from the EEA to the United Kingdom, which was due to expire on 27 December 2025 for a further six years until 27 December 2031. This extension means that, for now, data flows between European-based entities and UK organisations can continue without the need for additional safeguards or complex contractual arrangements, such as Standard Contractual Clauses.
What Does the Adequacy Extension Mean for Employers?
In practice, the adequacy decision allows employers to process and transfer personal data from the EU to the UK as if the UK were still part of the EU’s data protection regime. This avoids the administrative burdens and compliance costs that would otherwise arise if the adequacy status were to lapse. For HR teams, legal counsel, and data protection officers, the extension ensures continuity and certainty in payroll processing, talent acquisition, and workforce management activities that rely on transnational data transfers.
The Recent Regulatory Challenge: Data (Use and Access) Act 2025
As mentioned above, the extension was not a foregone conclusion. The EU’s adequacy decision came under scrutiny following the UK’s recent Data (Use and Access) Act 2025 (‘DUA Act‘). This legislation raised concerns about whether UK law continued to offer a level of data protection ‘essentially equivalent’ to that of the EU. There was concern that the EU might revoke or fail to renew the UK’s adequacy status, which would have forced employers to implement alternative transfer mechanisms, increasing compliance complexity and cost.
Thankfully for employers, this concern did not come into fruition. Furthermore, the DUA Act is still set on its course to make changes to the UK’s data protection regime as planned and as summarised in our article here. Notably, one of the changes under the DUA Act is a change to the regime permitting transfers of data from the UK to third countries (including the EU), although, along with many of the provisions under the DUA Act, these changes are not yet in force. Regulations bringing the relevant provisions into force are expected in early 2026.
Key Takeaways for Employers
- Business as usual: Data transfers from the EU to the UK can continue without disruption or new paperwork
- Watch this space: The adequacy extension is a vote of confidence, but employers should monitor ongoing legal developments, as further changes in UK legislation could affect future adequacy decisions
For the moment, the message is clear: the adequacy extension means data transfers can continue smoothly, sparing employers additional compliance burdens, but given the evolving legislative landscape, employers should remain alert for further regulatory shifts.
