The UK’s data-protection regime has finally been given the seal of approval by the European Union.

The long-awaited award of data adequacy status means that businesses and public bodies can continue to freely transfer information, as required, between this country and organisations in the remaining 27 member states. 

Adequacy has been awarded for the transfer of personal information related to both law enforcement matters and general data for other public service or commercial purposes.

After a process that has lasted longer than a year, the decision issued by the European Commission said that the UK’s data-protection statutes “ensure a level of protection for personal data transferred from the European Union that is essentially equivalent to the one guaranteed”.

Related content

• EU gives provisional thumbs-up to UK privacy regime
• EU data transfers: UK legislates ‘transitional’ measures for post-transition period
• Policy on public sector use of US cloud under review as uncertainty grows over post-Brexit data transfers

“Moreover, the commission considers that, taken as a whole, the oversight mechanisms and redress avenues in UK law enable infringements to be identified and punished in practice and offer legal remedies to the data subject to obtain access to personal data relating to him or her and, eventually, the rectification or erasure of such data,” the decision added. “Finally, on the basis of the available information about the UK legal order, the commission considers that any interference with the fundamental rights of the individuals whose personal data are transferred from the European Union to the UK by UK public authorities for public interest purposes, in particular law enforcement and national security purposes, will be limited to what is strictly necessary to achieve the legitimate objective in question, and that effective legal protection against such interference exists.”

The UK has thus joined a collection of countries and territories – including Andorra, Argentina, the Faroe Islands, Guernsey, Israel, the Isle of Man, Japan, Jersey, New Zealand, Switzerland, Uruguay and, for commercial purposes, Canada – that has achieved adequacy.

In the UK’s case, the status will apply for an initial term of four years. If the conclusions of the decision “are still factually and legally justified”, it will then be extended for a further four years.

Digital secretary Oliver Dowden said ratification of adequacy status would be “welcome news to businesses”.

“We will now focus on unlocking the power of data to drive innovation and boost the economy while making sure we protect people’s safety and privacy,” he added.

Julian David, chief executive of industry body techUK, said that “securing an EU-UK adequacy decision has been a top priority for techUK and the wider tech industry since the day after the 2016 referendum”.

“The decision that the UK’s data protection regime offers an equivalent level of protection to the EU GDPR is a vote of confidence in the UK’s high data protection standards and is of vital importance to UK-EU trade as the free flow of data is essential to all business sectors,” he added.