EDPB opinion on technical extension of UK adequacy decisions

Opinion 06/2025 regarding the extension of the European Commission Implementing Decisions under the GDPR and the LED on the adequate protection of personal data in the United Kingdom Adopted on 5 May 2025 The European Data Protection Board Having regard to Article 70(1)(s) of the Regulation 2016/679/EU of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter “GDPR”), Having regard to Article 51(1)(g) of the Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA (hereinafter “Law Enforcement Directive”), Having regard to the European Economic Area Agreement (EEA) and in particular to Annex XI and Protocol 37 thereof, as amended by the Decision of the EEA joint Committee No 154/2018 of 6 July 20181, Having regard to Article 12 and Article 22 of its Rules of Procedure, HAS ADOPTED THE FOLLOWING OPINION: 1. On 28 June 2021, the European Commission adopted two adequacy decisions for the United Kingdom of...