These decisions confirm that the United Kingdom continues to provide a level of protection of personal data comparable to that of the European Union, allowing personal data to flow freely and securely between the European Economic Area (EEA) and the United Kingdom. The extension was granted following the opinion of the European Data Protection Board and after obtaining the support of the Member States. The European Commission also drew on its assessment of the British legal framework, in particular the changes made by the Data (Use and Access) Act 2025.
The newly extended decisions will be valid for six years, i.e. until 27 December 2031. At the same time, the European Commission is planning an interim evaluation after four years. The extension ensures, in particular, the continuation of less stringent requirements for cross-border transfers of personal data between the EEA and the United Kingdom, without the need to introduce additional contractual mechanisms solely because the country is a non-EU country.