Data Protection and the EU
-
Due to the Data (Use and Access) Act coming into law on 19 June 2025, this guidance is under review and may be subject to change. The Plans for new and updated guidance page will tell you about which guidance will be updated and when this will happen.
On 19 December 2025 the European Commission renewed the two adequacy decisions for the UK:
This means that personal information can continue to flow from the EU to the UK.
Under the renewed GDPR decision, personal information for the purposes of UK immigration control, or which otherwise falls within the scope of the immigration exemption in the DPA, is now included.
We are updating our guidance for receiving personal information from the EEA.
The guidance on this page is suitable for large businesses in the public, private and third sectors. Small businesses should use the resources on our small business web hub.
Brief guidance
Overview - data protection and the EU
A brief overview of the changes to data protection since the UK left the EU and now has an approved adequacy decision.
Detailed guidance
Data protection and the EU - in detail
Detailed guidance about adequacy, international data transfers, European representatives, UK representatives and EU regulatory oversight, and law enforcement processing.