Privacy & Information Security Law Blog

On March 5, 2025, the European Data Protection Board (the “EDPB”) published Opinion 06/2025 on the extension of the European Commission Implementing Decisions under the GDPR and the Law Enforcement Directive on the adequate protection of personal data in the United Kingdom (the “Opinion”).

The Opinion was requested by the European Commission as the two current adequacy decisions are due to expire on June 27, 2025. For more background on the adequacy decisions, see our previous blog post here.

The extension of the adequacy decisions for a further six months gives the UK government time to enact the draft Data (Use and Access) Bill (the “DUA Bill”) which proposes several amendments to UK data protection law. The DUA Bill is currently in the House of Commons and likely to be finalised in the coming months. For further information on the changes to UK data legislation proposed by the DUA Bill, see here.

The EDPB clarified that the Opinion does not assess the UK data protection framework. Both the European Commission and the EDPB have stated their intentions to re-assess the UK legal framework following finalization of the proposed legislative changes in the UK, namely, the amends that shall be introduced upon the DUA Bill becoming enacted.