COMMISSION IMPLEMENTING DECISION (EU) 2025/1226

| Official Journal of the European Union | EN L series ---|---|--- * * * | 2025/1226 | 26.6.2025 ---|---|--- COMMISSION IMPLEMENTING DECISION (EU) 2025/1226 of 24 June 2025 amending Implementing Decision (EU) 2021/1772 pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council on the adequate protection of personal data by the United Kingdom (notified under document C(2025) 3928) (Text with EEA relevance) THE EUROPEAN COMMISSION, Having regard to the Treaty on the Functioning of the European Union, Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (1), and in particular Article 45(3) thereof, Whereas: (1) | Commission Implementing Decision (EU) 2021/1772 (2) concluded that for the purposes of Article 45 of Regulation (EU) 2016/679, the United Kingdom ensures an adequate level of protection for personal data transferred from the European Union to the United Kingdom within the scope of that Regulation (3). ---|--- (2) | When adopting Implementing Decision (EU) 2021/1772, the Commission took into account that, with the end of the transition period provided by the Agreement on the withdrawal of the United Kingdom of Great Britain and Northern Ireland from the European Union and the European Atomic Energy Community (4) and once the interim provision under Article 782 of the Trade and Cooperation Agreement between the European Union and the European Atomic Energy Community, of the one part, and the United Kingdom of Great Britain and Northern Ireland, of the other part (5) would have ceased to apply, the United Kingdom would adopt, apply and enforce a new data protection regime, different to the one in place when it was bound by Union law. As this may have notably involved amendments to the data protection framework assessed in Implementing Decision (EU) 2021/1772 or other relevant developments, it was considered appropriate to provide that that Decision would apply for a period of four years as of its entry into force. Implementing Decision (EU) 2021/1772 is therefore to expire on 27 June 2025, unless it is extended in accordance with the procedure referred to in Article 93(2) of Regulation (EU) 2016/679. ---|--- (3) | To decide on a possible renewal of Implementing Decision (EU) 2021/1772, the Commission must assess whether the conclusion that the United Kingdom ensures an adequate level of protection for personal data transferred from the European Union to the United Kingdom remains factually and legally justified. This assessment can only be carried out on the basis of a stable legal framework in place in the United Kingdom. ---|--- (4) | The data protection framework assessed in Implementing Decision (EU) 2021/1772, which is based on Union law, continues to apply in the United Kingdom. However, on 23 October 2024 the Government introduced the Data (Use and Access) Bill (6) into Parliament, proposing amendments to the United Kingdom General Data Protection Regulation and Data Protection Act 2018. ---|--- (5) | The validity of Implementing Decision (EU) 2021/1772 should therefore be extended for a period of six months in order to allow the Commission to carry out its assessment on the adequate level of protection for personal data provided by the United Kingdom on the basis of a stable legal framework, further to the conclusion of the ongoing legislative process before the United Kingdom Parliament. ---|--- (6) | The European Data Protection Board published an opinion (7) which has been taken into consideration in the preparation of this Decision. ---|--- (7) | The measure provided for in this Decision is in accordance with the opinion of the Committee established under Article 93 of Regulation (EU) 2016/679, ---|--- (8) | Implementing Decision (EU) 2021/1772 should therefore be amended accordingly, ---|--- HAS ADOPTED THIS DECISION: Article 1 Article 4 of Implementing Decision (EU) 2021/1772 is replaced by the following: ‘Article 4 This Decision shall expire on 27 December 2025, unless extended in accordance with the procedure referred to in Article 93(2) of Regulation (EU) 2016/679.’ Article 2 This Decision is addressed to the Member States. Done at Brussels, 24 June 2025. For the Commission Michael MCGRATH Member of the Commission * * * (1) OJ L 119, 4.5.2016, p. 1, ELI: http://data.europa.eu/eli/reg/2016/679/oj. (2) Commission Implementing Decision (EU) 2021/1772 of 28 June 2021 pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council on the adequate protection of personal data by the United Kingdom (OJ L 360, 11.10.2021, p. 1, ELI: http://data.europa.eu/eli/dec_impl/2021/1772/oj). (3) See Article 1(1) of Decision (EU) 2021/1772. Under Article 1(2) of that Decision, the Decision does not cover personal data transferred for the purposes of United Kingdom immigration control or otherwise falling under the scope of the exemption for certain data subject rights for the purposes of maintaining effective immigration control pursuant to paragraph 4(1) of Schedule 2 to the UK Data Protection Act 2018. (4) OJ C 384I, 12.11.2019, p. 1. (5) OJ L 149, 30.4.2021, p. 10, ELI: http://data.europa.eu/eli/agree_internation/2021/689(1)/oj. (6) Available at the following link: https://bills.parliament.uk/bills/3825/news. (7) Opinion 6/2025 regarding the extension of the European Commission Implementing Decisions under the GDPR and under the LED on the adequate protection of personal data in the United Kingdom, available at the following link https://www.edpb.europa.eu/system/files/2025-05/edpb-opinion-202506-uk- adequacyextension-gdpr-led_en.pdf. * * * ELI: http://data.europa.eu/eli/dec_impl/2025/1226/oj ISSN 1977-0677 (electronic edition) * * *