The long awaited decision regarding UK Adequacy was made end of last month, on the 28th of June. While the UK has achieved adequacy statement, there is something of a watching brief on this.
For the first time ever, the EU Commission has made Adequacy conditional. Unusual, but perhaps unsurprisingly the UK is subject to additional caveats. The Adequacy approval will only last a period of 4 years from date adequacy comes into force, and the EU Commission may intervene should there be any changes to UK legislation which will affect personal data processing. This so-called “sunset clause” means we be back here again in four years time (or sooner) if a political decision is taken to create a divergent data protection regime for the UK which doesn’t meet adequacy requirements.
What this decision does give UK business is some breathing space regarding cross border data processes to the EU. It means cross-border processing may continue without having to put additional safeguards such as standard contractual clauses in place. Although it does not mean this now means businesses can relax a little about meeting GDPR requirements! Adequacy is approved for nations that can demonstrate they have an equivalent data protection regime to the GDPR. The UK has done that for now, but given the caveats, it does feel almost like the UK is on some form of probation.