On 28 June 2021, the EU confirmed that it had formally approved the EU Adequacy Decision for the UK.

This is good news for Member organisations who transfer personal data from the Republic of Ireland or any other EU (EEA) States to Northern Ireland, as the decision means that:

• UK is no longer treated as a third country;
• Personal data can now flow freely from EU to UK, as the EU has found that the UK offer an essentially equivalent level of protection to that guaranteed under EU law.

Earlier this year the UK recognised EEA Member States as having ‘adequate protection’ for personal data, therefore personal data can also be transferred from the UK to the EU without businesses having to apply additional safeguards.

For the first time ever in its Adequacy Decision, the EU have included what is known as a ‘sunset clause.’ This clause limits the duration of the Adequacy Decision to four years, after which it will automatically expire.  At that stage, the EU will then review it and will only renew the Adequacy Decision if the UK continues to ensure an adequate level of data protection.  Consequently it will be important for the UK to keep pace with any changes to Data Protection rules in the EU.

Member organisations should of course ensure that Privacy Notices and relevant GDPR documentation identify if personal data is being transferred outside the country, and provide other necessary details such as where it is being transferred, how it will be used, stored and who will have access etc.

The Adequacy Decision can be accessed here and the announcement here.