Brexit created a potential rupture in the free flow of personal data between the UK and the EU. In practice, mutual adequacy decisions — the EU recognising the UK as adequate, and the UK recognising the EU as adequate — mean that personal data can flow freely in both directions without additional safeguards. But adequacy is not permanent, and companies should understand both the current position and the risk of change.
The Current Position
EU → UK transfers: The EU adopted an adequacy decision for the UK in June 2021. This means personal data can be transferred from the EU to the UK without additional safeguards (no SCCs required, no IDTA needed). The EU adequacy decision for the UK is currently valid.
UK → EU transfers: The UK has made its own adequacy regulations covering the EEA countries (EU member states plus Norway, Iceland, Liechtenstein). UK personal data can be transferred to the EU freely.
Result: For data flowing directly between the EU and UK, no additional transfer mechanisms are needed. The mutual adequacy position makes EU-UK data flows essentially frictionless for UK-established companies with EU operations.
The Adequacy Risk
Mutual adequacy is not permanent:
EU adequacy for the UK: The EU adequacy decision is subject to review every four years (next review: 2025/2026). The EU Commission has confirmed the review is ongoing. Key concern: whether the UK's data protection law divergence under the DPDI Act remains compatible with EU adequacy standards. If adequacy lapses, EU → UK transfers would require SCCs or IDTA as fallback.
Practical advice: Maintain IDTA or UK Addendum to EU SCCs as a drafted but unexecuted fallback. If adequacy is withdrawn, you can activate the fallback mechanisms without starting from scratch.
UK → US and UK → Non-EEA Transfers
For transfers from the UK to countries other than the EU/EEA, the EU-UK adequacy position is irrelevant. These transfers require:
UK → US: The UK has established its own data bridge arrangement with the US — the UK-US Data Bridge (which extends to UK-law-compliant certification under the Data Privacy Framework). US companies certified under the DPF can also seek UK extension certification.
For US vendors that are not UK bridge certified: the IDTA (International Data Transfer Agreement) is the UK SCC equivalent.
UK → Other third countries:
- If the UK has made an adequacy regulation for that country: free transfer
- If not: IDTA or UK Addendum to EU SCCs
The UK's adequacy list includes most EU/EEA countries plus others (Switzerland is included — the UK recognises Switzerland as adequate). For transfers to countries not on this list, UK transfer mechanisms apply.
Companies with EU and UK Operations
For companies with both EU and UK operations, managing transfers is more complex:
EU establishment → UK establishment: EU adequacy for UK allows this transfer.
UK establishment → EU establishment: UK adequacy for EU allows this transfer.
Intra-group transfers (EU parent, UK subsidiary): The EU → UK transfer is covered by adequacy. The UK subsidiary may need UK GDPR-compliant processing agreements for data received from the EU entity.
EU establishment → US infrastructure: EU SCCs (2021) required. UK establishment → US infrastructure: IDTA or UK Bridge certification required.
If the same US vendor (e.g., AWS) processes data from both your EU and UK entities, you need:
- EU SCC executed between EU entity and AWS
- IDTA or UK Addendum executed between UK entity and AWS
These are separate documents, even if the vendor is the same.
Practical Steps for UK-EU Data Flows
Document your data flows:
- Map which personal data moves between UK and EU entities
- Map which data moves from UK or EU to third countries
Confirm adequacy applies:
- EU → UK: yes, currently
- UK → EU: yes, currently
Maintain fallback documentation:
- Draft IDTA or UK Addendum for EU → UK as a fallback (unexecuted but ready)
- If adequacy lapses, execute within days
Audit US vendors for UK coverage:
- Check if your US vendors have separate UK Bridge certification
- If not, execute IDTA for UK → US transfers
Update privacy notices:
- Disclose cross-border transfers including EU-UK flows
- Identify the mechanism (adequacy) in the notice
Monitoring the Adequacy Position
The EU adequacy review of the UK is a live situation. Monitor:
- EDPB statements on UK adequacy
- UK DPDI Act implementation — significant divergence could trigger EU concerns
- ICO and EU DPA joint working group communications
If adequacy is at risk, the UK ICO and EU Commission will announce before any transition. Companies will have time to activate fallback mechanisms. But companies that have not prepared their fallback mechanisms will scramble.