On 28 June 2021, the European Commission adopted two data adequacy decisions under the EU GDPR and the Law Enforcement Directive, allowing personal data to continue to flow freely from the EU and EEA to the UK. These decisions mean that UK businesses and organisations can continue to receive personal data from the EU and EEA without having to put additional arrangements, such as standard contractual clauses (SCCs), in place with European counterparts.

Both adequacy decisions are, however, limited in duration to four years, and will automatically expire four years after their entry into force. After that period, the adequacy decisions may be renewed by the European Commission, but only if the UK continues to ensure an adequate level of data protection, assessed according to EU standards. 

Source: New feed