An EU adequacy decision is a formal recognition by the EU that a non-EU country – in this case, the UK – has adequate data protection laws that protect the privacy of individuals’ personal data to the EU’s satisfaction. It means that additional steps to protect such personal data – such as requiring that every legal agreement under which personal data is to be moved between the UK and EEA contains special protective clauses, known as Model or Standard Contractual Clauses – do not have to be taken by the businesses concerned.
The same is also true in relation to personal data a UK organisation receives from or sends to any other ‘third’ (ie non-EEA) country benefiting from an EU data protection adequacy decision.
The updated UK guidance ‘Guidance: Using personal data in your business or other organisation’ covers the action UK organisations need to take regarding data protection and data flows with the EU/EEA. It includes sections on ‘what personal data is’ and on ‘receiving personal data from the EU/EEA and from third countries which have EU adequacy decisions’.
However, the adequacy decision will be reviewed after four years (in June 2025) and can be suspended, repealed or amended at any time.
Operative date
- Now
Recommendation
- UK organisations receiving and transferring personal data from and to the EEA should check out the UK Guidance on the GOV.UK website.
This article from Atom Content Marketing is for general guidance only, for businesses in the United Kingdom governed by the laws of England. Atom Content Marketing, expert contributors and ICAEW (as distributor) disclaim all liability for any errors or omissions.
Copyright © Atom Content Marketing
ICAEW Business Advice Service
Grow your business with trusted business advice. We connect entrepreneurs, start-ups, and SMEs with ICAEW regulated accountancy firms who will provide a free initial consultation without obligation.
