Upon a thorough assessment of the UK’s law and practice on personal data protection, two adequacy decisions for the United Kingdom (UK), one under the General Data Protection Regulation (GDPR) and the other for the Law Enforcement Directive (EU Directive 2016/680), have been issued on 28/06/2021 by the European Commission, recognizing the UK as a country where an essentially equivalent level of data protection to that guaranteed under European Union (EU) law is ensured as per Article 45 of the GDPR.

According to such decisions, not yet published in the Official Journal of the European Union, personal data can freely flow from the EU to the UK without the need to implement any cross-border data transfer mechanism, such as the conclusion of the Standard Contractual Clauses (SCCs).

It should be pointed out that for the first time the adequacy decisions have a strictly limited duration (so-called ‘sunset clause’), they will namely expire automatically four years after their entry into force. The European Commission shall evaluate the legal status in the UK during the period of the decisions’ enactment and, as agreed, intervene at any point, in case of any divergence from the level of data protection that currently applies. After that period, the level of data protection in the UK will be reassessed and the adequacy decisions might be renewed, provided through that the UK continues to safeguard an adequate level of data protection according to the EU legal standards required under the GDPR.