The European Commission has today announced the draft UK adequacy decision. This will allow the continued free flow of data from the EU to the UK after deciding that the UK has ensured an adequate level of protection for personal data.

Register for the webinar: UK Adequacy Decision Reaction & Analysis

What Does an Adequacy Decision Mean?

An adequacy decision by the European Commission is a ruling that a third country, territory, sector or international organization offers a level of data protection that is equivalent to that provided within the EU. An adequacy decision allows cross-border data transfers from the EU to a third country without needing any additional safeguards or authorization by a supervisory authority.

The UK adequacy decision will replace the temporary solution that is currently in place, agreed under the EU-UK Trade and Cooperation Agreement, which allows the continued transfer of personal data from the EU to the UK until June 30, 2021. The UK Government has indicated that it intends to accept the EU Commission’s adequacy ruling before the end of the transition period, ensuring the continued free flow of data.

For many organizations this decision will come as a relief, especially those that rely on the regular transfer of personal data such as the health, financial, and technology sectors. Data transfers can continue without having to rely on alternative transfer mechanisms and safeguards. Notably, the decision will also help continued collaboration on police matters and the prevention of serious crime.

Register for the webinar: UK Adequacy Decision Reaction & Analysis

What’s Next for the UK Adequacy Decision?

The EU Commission’s decision to grant the UK adequacy ruling will now be examined by the European Data Protection Board (EDPB),  and will then be subject to review by a committee of EU Member States. Adequacy arrangements will be subject to a reassessment every four years, to unsure that UK rules do not jeopardize EU citizens’ privacy

This keenly awaited adequacy ruling will come as a relief to many organizations who were beginning to look at alternative safeguards to continue GDPR compliant data transfers. The UK’s previous alignment with the GDPR will no doubt have been a considerable asset in this ruling. For reaction and analysis of the adequacy decision register for the webinar, or find out more about how OneTrust can help your privacy program meet the GDPR requirements.

Further UK Adequacy reading: 

Further Information on Data Transfers Impacted by the Schrems II Ruling:

Next steps on UK Adequacy: