COMMISSION IMPLEMENTING DECISION (EU) 2025/1225

| Official Journal of the European Union | EN L series ---|---|--- * * * | 2025/1225 | 26.6.2025 ---|---|--- COMMISSION IMPLEMENTING DECISION (EU) 2025/1225 of 24 June 2025 amending Implementing Decision (EU) 2021/1773 pursuant to Directive (EU) 2016/680 of the European Parliament and of the Council on the adequate protection of personal data by the United Kingdom (notified under document C(2025) 3898) THE EUROPEAN COMMISSION, Having regard to the Treaty on the Functioning of the European Union, Having regard to Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA (1), and in particular Article 36(3) thereof, Whereas: (1) | In its Implementing Decision (EU) 2021/1773 (2), the Commission concluded that, for the purposes of Article 36 of Directive (EU) 2016/680, the United Kingdom ensures an adequate level of protection for personal data transferred from the European Union to the public authorities in the United Kingdom responsible for the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties. ---|--- (2) | When adopting Implementing Decision (EU) 2021/1773, the Commission took into account that, with the end of the transition period provided by the Agreement on the withdrawal of the United Kingdom of Great Britain and Northern Ireland from the European Union and the European Atomic Energy Community (3) and once the interim provision under Article 782 of the Trade and Cooperation Agreement between the European Union and the European Atomic Energy Community, of the one part, and the United Kingdom of Great Britain and Northern Ireland, of the other part (4) would have ceased to apply, the United Kingdom would adopt, apply and enforce a new data protection regime, different to the one in place when it was bound by Union law. As this may have notably involved amendments or changes to the data protection framework assessed in Implementing Decision (EU) 2021/1773, as well as other relevant developments, it was considered appropriate to provide that that Decision would apply for a period of four years as of its entry into force. Implementing Decision (EU) 2021/1773 is therefore to expire on 27 June 2025, unless it is extended in accordance with the procedure referred to in Article 58(2) of Directive (EU) 2016/680. ---|--- (3) | To decide on a possible renewal of Implementing Decision (EU) 2021/1773, the Commission must assess whether the conclusion that the United Kingdom ensures an adequate level of protection remains factually and legally justified. This assessment can only be carried out on the basis of a stable legal framework in place in the United Kingdom. ---|--- (4) | The United Kingdom’s data protection framework assessed in Implementing Decision (EU) 2021/1773, which is based on Union law, continues to apply in the United Kingdom. However, on 23 October 2024 the United Kingdom Government introduced the Data (Use and Access) Bill (5) into the United Kingdom Parliament proposing amendments to the United Kingdom General Data Protection Regulation and the Data Protection Act 2018. ---|--- (5) | The validity of Implementing Decision (EU) 2021/1773 should therefore be extended for six months in order to allow the Commission to carry out its assessment on the adequate level of protection for personal data provided by the United Kingdom on the basis of a stable legal framework, further to the conclusion of the ongoing legislative process before the United Kingdom Parliament. ---|--- (6) | The European Data Protection Board published its opinion (6), which has been taken into consideration in the preparation of this Decision. ---|--- (7) | The measure provided for in this Decision is in accordance with the opinion of the Committee established under Article 58 of Directive (EU) 2016/680. ---|--- (8) | In accordance with Article 6a of Protocol No 21 on the position of the United Kingdom and Ireland in respect of the area of freedom, security and justice, as annexed to the TEU and to the TFEU, Ireland is not bound by the rules laid down in Directive (EU) 2016/680, and hence this implementing decision, which relate to the processing of personal data by the Member States when carrying out activities which fall within the scope of Chapter 4 or Chapter 5 of Title V of Part Three of the TFEU where Ireland is not bound by the rules governing the forms of judicial cooperation in criminal matters or police cooperation which require compliance with the provisions laid down on the basis of Article 16 TFEU. Nevertheless, by virtue of Council Implementing Decision (EU) 2020/1745 (7), Directive (EU) 2016/680 is to be put into effect and applied on a provisional basis in Ireland as of 1 January 2021. Ireland is therefore bound by this Decision, under the same conditions as apply to the application of Directive (EU) 2016/680 in Ireland as set out in Implementing Decision (EU) 2020/1745, as regards the part of the Schengen acquis in which it participates. ---|--- (9) | In accordance with Articles 2 and 2a of Protocol No 22 on the position of Denmark, annexed to the Treaty on European Union and to the Treaty on the Functioning of the European Union, Denmark is not bound by the rules laid down in Directive (EU) 2016/680, and hence this Implementing Decision, or subject to their application which relate to the processing of personal data by the Member States when carrying out activities which fall within the scope of Chapter 4 or Chapter 5 of Title V of Part Three of the TFEU. However, given that Directive (EU) 2016/680 builds upon the Schengen acquis, Denmark, in accordance with Article 4 of that Protocol, notified on 26 October 2016 its decision to implement Directive (EU) 2016/680. Denmark is therefore bound under international law to implement this Decision. ---|--- (10) | As regards Iceland and Norway, this Decision constitutes a development of provisions of the Schengen acquis, within the meaning of the Agreement concluded by the Council of the European Union and the Republic of Iceland and the Kingdom of Norway concerning the association of those two States with the implementation, application and development of the Schengen acquis (8). ---|--- (11) | As regards Switzerland, this Decision constitutes a development of provisions of the Schengen acquis, within the meaning of the Agreement between the European Union, the European Community and the Swiss Confederation concerning the association of the Swiss Confederation with the implementation, application and development of the Schengen acquis (9). ---|--- (12) | As regards Liechtenstein, this Decision constitutes a development of provisions of the Schengen acquis, within the meaning of the Protocol between the European Union, the European Community, the Swiss Confederation and the Principality of Liechtenstein on the accession of the Principality of Liechtenstein to the Agreement between the European Union, the European Community and the Swiss Confederation on the Swiss Confederation’s association with the implementation, application and development of the Schengen acquis (10). ---|--- (13) | Implementing Decision (EU) 2021/1773 should therefore be amended accordingly, ---|--- HAS ADOPTED THIS DECISION: Article 1 Article 4 of Implementing Decision (EU) 2021/1773 is replaced by the following: ‘Article 4 This Decision shall expire on 27 December 2025, unless extended in accordance with the procedure referred to in Article 58(2) of Directive (EU) 2016/680.’. Article 2 This Decision is addressed to the Member States. Done at Brussels, 24 June 2025. For the Commission Michael MCGRATH Member of the Commission * * * (1) OJ L 119, 4.5.2016, p. 89, ELI: http://data.europa.eu/eli/dir/2016/680/oj. (2) Commission Implementing Decision (EU) 2021/1773 of 28 June 2021 pursuant to Directive (EU) 2016/680 of the European Parliament and of the Council on the adequate protection of personal data by the United Kingdom (OJ L 360, 11.10.2021, p. 69, ELI: http://data.europa.eu/eli/dec_impl/2021/1773/oj). (3) OJ C 384I, 12.11.2019, p. 1. (4) OJ L 149, 30.4.2021, p. 10, ELI: http://data.europa.eu/eli/agree_internation/2021/689(1)/oj. (5) Available at the following link: https://bills.parliament.uk/bills/3825/news. (6) Opinion 6/2025 regarding the extension of the European Commission Implementing Decisions under the GDPR and under the LED on the adequate protection of personal data in the United Kingdom, available at the following link https://www.edpb.europa.eu/system/files/2025-05/edpb-opinion-202506-uk- adequacyextension-gdpr-led_en.pdf. (7) Council Implementing Decision (EU) 2020/1745 of 18 November 2020 on the putting into effect of the provisions of the Schengen acquis on data protection and on the provisional putting into effect of certain provisions of the Schengen acquis in Ireland (OJ L 393, 23.11.2020, p. 3, ELI: http://data.europa.eu/eli/dec_impl/2020/1745/oj). (8) OJ L 176, 10.7.1999, p. 36, ELI: http://data.europa.eu/eli/agree_internation/1999/439(1)/oj. (9) OJ L 53, 27.2.2008, p. 52. (10) OJ L 160, 18.6.2011, p. 21. * * * ELI: http://data.europa.eu/eli/dec_impl/2025/1225/oj ISSN 1977-0677 (electronic edition) * * *