Brexit
Do you, as an organisation in the European Economic Area (EEA), transfer personal data to organisations in the United Kingdom (UK)? Then you can continue doing this as usual. Even though the UK is no longer part of the EEA because of Brexit.
On this page
Free data exchange with the UK
The European Commission (EC) has taken 2 adequacy decisions for the UK (1 for the GDPR and 1 for the Directive on data protection in the law enforcement sector). By taking these decisions, the EC considers the level of protection of personal data in the UK to be equivalent to that in the EEA.
This means that you can freely exchange data with the UK. You therefore do not have to use transfer instruments such as a model contract, which you would normally need for transfers to a country outside the EEA.
Receiving data from the UK
Organisations in the UK can also freely send personal data to organisations in the EEA. This was announced by the British government. So do you receive data from the UK? Then Brexit does not affect this either.
The current adequacy assessment for the UK expired on 27 June 2025. The EDPB agreed to the EC's request to extend the validity of the assessment by 6 months (until 27 December 2025) to allow the EC sufficient time to reassess the UK's adequacy. Until a new (positive) assessment is made, the old adequacy assessment will remain in force.