Gelex

Commission Implementing Decision (EU) 2025/1226 of 24 June 2025 amending Implementing Decision (EU) 2021/1772 pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council on the adequate protection of personal data by the United Kingdom (notified under document C(2025) 3928) (Text with EEA relevance)

In forceVersion 2025-06-24from 2025-06-25
Grade B

mapped from publisher markup. A grade says how a document's structure was obtained, not how reliable the law is.

Ask Gelex about this law

Address https://gelex.eu/eli/EU/decision/2025/1226@2025-06-24/en

Contents
  1. Preamble
    1. Article 1
  3. Article 1
    1. Article 4
    1. Article 2

THE EUROPEAN COMMISSION,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), and in particular Article 45(3) thereof,

Whereas:

(1) Commission Implementing Decision (EU) 2021/1772 concluded that for the purposes of Article 45 of Regulation (EU) 2016/679, the United Kingdom ensures an adequate level of protection for personal data transferred from the European Union to the United Kingdom within the scope of that Regulation.

(2) When adopting Implementing Decision (EU) 2021/1772, the Commission took into account that, with the end of the transition period provided by the Agreement on the withdrawal of the United Kingdom of Great Britain and Northern Ireland from the European Union and the European Atomic Energy Community and once the interim provision under Article 782 of the Trade and Cooperation Agreement between the European Union and the European Atomic Energy Community, of the one part, and the United Kingdom of Great Britain and Northern Ireland, of the other part would have ceased to apply, the United Kingdom would adopt, apply and enforce a new data protection regime, different to the one in place when it was bound by Union law. As this may have notably involved amendments to the data protection framework assessed in Implementing Decision (EU) 2021/1772 or other relevant developments, it was considered appropriate to provide that that Decision would apply for a period of four years as of its entry into force. Implementing Decision (EU) 2021/1772 is therefore to expire on 27 June 2025, unless it is extended in accordance with the procedure referred to in Article 93(2) of Regulation (EU) 2016/679.

(3) To decide on a possible renewal of Implementing Decision (EU) 2021/1772, the Commission must assess whether the conclusion that the United Kingdom ensures an adequate level of protection for personal data transferred from the European Union to the United Kingdom remains factually and legally justified. This assessment can only be carried out on the basis of a stable legal framework in place in the United Kingdom.

(4) The data protection framework assessed in Implementing Decision (EU) 2021/1772, which is based on Union law, continues to apply in the United Kingdom. However, on 23 October 2024 the Government introduced the Data (Use and Access) Bill into Parliament, proposing amendments to the United Kingdom General Data Protection Regulation and Data Protection Act 2018.

(5) The validity of Implementing Decision (EU) 2021/1772 should therefore be extended for a period of six months in order to allow the Commission to carry out its assessment on the adequate level of protection for personal data provided by the United Kingdom on the basis of a stable legal framework, further to the conclusion of the ongoing legislative process before the United Kingdom Parliament.

(6) The European Data Protection Board published an opinion which has been taken into consideration in the preparation of this Decision.

(7) The measure provided for in this Decision is in accordance with the opinion of the Committee established under Article 93 of Regulation (EU) 2016/679,

(8) Implementing Decision (EU) 2021/1772 should therefore be amended accordingly,

HAS ADOPTED THIS DECISION:

Article 1

Article 4 of Implementing Decision (EU) 2021/1772 is replaced by the following: Art. 004. This Decision shall expire on 27 December 2025, unless extended in accordance with the procedure referred to in Article 93(2) of Regulation (EU) 2016/679.

Article 1

Article 4

This Decision shall expire on 27 December 2025, unless extended in accordance with the procedure referred to in Article 93(2) of Regulation (EU) 2016/679.

Article 2

This Decision is addressed to the Member States.

Done at Brussels, 24 June 2025. For the Commission Michael Mcgrath Member of the Commission

Versions

  1. 2025-06-24

Cited by