edpb-opinion-202506-uk-adequacyextension-gdpr-led_en.pdf

The European Data Protection Board (EDPB) has adopted an opinion regarding the extension of Commission Implementing Decisions under the General Data Protection Regulation (GDPR) and Law Enforcement Directive (LED) on the adequate protection of personal data in the United Kingdom.

Key points:

• The decisions include a sunset clause, set to expire on June 27, 2025.
• The UK government introduced a Data (Use and Access) Bill, proposing to amend certain elements of UK data protection law.
• The European Commission proposed a technical and time-limited extension of the decisions for six months, until December 27, 2025.
• The EDPB recognises the necessity of this extension, allowing the Commission to assess the updated UK legal framework once it has been adopted.
• The extension is exceptional, caused by the ongoing legislative process in the UK, and should not be further prolonged.
• The European Commission must closely monitor relevant developments in the UK and take swift appropriate actions, where necessary.