What is adequacy?
‘Adequacy’ is a term that the EU uses to describe other countries, territories, sectors or international organisations that it deems to provide an ‘essentially equivalent’ level of data protection to that which exists within the EU.
An adequacy decision is a formal decision made by the EU which recognises that another country, territory, sector or international organisation provides an equivalent level of protection for personal data as the EU does.
On 28 June 2021, the EU Commission published two adequacy decisions in respect of the UK:
- one for transfers under the EU GDPR; and
- the other for transfers under the Law Enforcement Directive (LED).
These decisions contain the European Commission’s detailed assessment of the UK’s laws and systems for protecting personal data, as well as the legislation designating the UK as adequate.
Both adequacy decisions are expected to last until 27 June 2025. The European Commission will start work later in 2024 to decide whether to extend the adequacy decisions for the UK for a further period up to a maximum of another four years. If they don’t extend the decisions, then they will expire on 27 June 2025.
Can the adequacy decisions end earlier?
Yes. The European Commission must monitor developments in the UK on an ongoing basis to ensure that the UK continues to provide an equivalent level of data protection. Alternatively, EU data subjects or an EU data protection authority can initiate a legal challenge to adequacy decisions. The Court of Justice of the European Union would then have to decide whether the UK did provide essentially equivalent protection.
What does the EU GDPR adequacy decision say?
The EU GDPR adequacy decision says that the UK provides adequate protection for personal data transferred from the EU to the UK under the EU GDPR.
However, transfers of personal data for the purposes of UK immigration control, or which would otherwise fall within the scope of the immigration exemption in the DPA 2018, are excluded from the scope of the adequacy decision. This may also affect which version of the data protection regime applies in the UK to data processed for immigration control purposes. Our section below on receiving EEA data provides information on what you need to consider under these circumstances.
What does the Law Enforcement Directive adequacy decision say?
The LED adequacy decision also says the UK provides adequate protection for personal data transferred from EU authorities responsible for the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties. Our section on law enforcement processing provides information on what you should consider if you are a UK competent authority processing for law enforcement processing under Part 3 of the Data protection Act 2018.