On 28 June 2021, the EU Commission confirmed that it had adopted an adequacy decision for the UK under the EU GDPR. This means that personal data can continue to flow freely from the European Economic Area into the UK without the need for additional safeguards, such as Standard Contractual Clauses or SCCs, to be put in place.
The decision has a time limit and is set to automatically expire four years after coming into effect. The adequacy status can be renewed by the Commission providing that the UK maintains an adequate level of data protection.
Organisations should continue to implement the compliance requirements previously outlined in the CLC guidance and refer to the resources and advice provided by the ICO, EDPB and UK Government.
Helpful resources:
Data protection now the transition period has ended | ICO
Using personal data in your business or other organisation – gov.uk
Commission adopts adequacy decisions for the UK (europa.eu)
CLC – EU exit business readiness data protection and GDPR
