United Kingdom: Cross-Border & Adequacy

Inbound EEA-to-UK personal data flows continue without supplementary transfer mechanisms following the European Commission's adoption on 19 December 2025 of Implementing Decision (EU) 2025/2545 (under Art. 45 GDPR) and Implementing Decision (EU) 2025/2546 (under Art. 36 Law Enforcement Directive), which renewed the UK's adequacy decisions for a further six years until 27 December 2031 after evaluating the enacted Data (Use and Access) Act 2025. EEA Joint Committee Decision No 37/2026 of 20 February 2026 incorporated both renewals into Annex XI to the EEA Agreement for Iceland, Liechtenstein, and Norway. Outbound restricted transfers from the UK under Chapter V UK GDPR are governed from 5 February 2026 by DUAA 2025 Schedule 7 (commenced by SI 2026/82), which replaces the former Art. 45/46 'essentially equivalent' standard with a statutory 'data protection test': whether the standard of protection provided for data subjects in the destination country or organisation is 'not materially lower' than the standard under UK data protection legislation. UK outbound transfers rely on UK adequacy regulations (covering EEA Member States, Gibraltar, countries holding EU adequacy, the UK Extension to the EU–US Data Privacy Framework effective 12 October 2023, Republic of Korea, and Guernsey/Jersey/Isle of Man), the ICO International Data Transfer Agreement (IDTA), the UK Addendum to the EU 2021 SCCs, or UK Binding Corporate Rules, supported by a Transfer Risk Assessment (TRA) applying the 'not materially lower' test.