European Commission endorses DUA Act changes, starts adequacy renewal process

The European Commission has initiated the process to adopt new adequacy decisions that will continue to facilitate the free flow of personal data between the European Economic Area (EEA) and the United Kingdom (UK). 

The announcement follows the Commission's assessment of the recently enacted Data (Use and Access) Act 2025 (DUA Act), in which the Commission confirmed that the UK's legal framework maintains "data protection safeguards that are essentially equivalent to those provided by the EU." The next step in the adoption procedure involves sending the draft decisions to the European Data Protection Board (EDPB) for its opinion. Subsequently, the Commission will seek approval from a committee comprising representatives of EU Member States. The European Parliament also retains the right to scrutinise the two adequacy decisions, ensuring a thorough review process before final adoption. 

In a statement, Executive Vice-President of the European Commission for Technological Sovereignty, Security and Democracy, Henna Virkkunen, said: "Data protection is a cornerstone of EU values. And the United Kingdom a key partner. By upholding rigorous standards, we ensure trust in digital cooperation—and this decision reaffirms our commitment to both privacy and our continued partnership with the UK."