If your business receives customer or staff data from the EU — a supplier list, a payroll feed, enquiries from European customers — there was a quiet deadline at the end of 2025 that could have made all of that far more expensive. It passed without disruption.
On 19 December 2025 the European Commission renewed the UK's adequacy status.[18] In plain terms, the EU still trusts UK data protection enough to let personal data move from Europe to the UK without extra paperwork.
What adequacy actually does for you
Adequacy is the EU's stamp of approval. With it, an EU company can send personal data to a UK company the same way it would to a company inside the EU. No special contracts. No transfer risk assessments. Nothing extra to sign.
Without it, every one of those data flows would need its own legal safeguard, usually a set of standard contractual clauses plus a documented risk assessment. For a small business that buys from or sells to Europe, that is real cost and real delay.
The catch in the small print
The renewal runs to 27 December 2031, with a built-in sunset clause and a periodic review along the way.[18] The UK is the only country whose adequacy is time-limited in this way.
The reason matters. The EU expects the UK to keep its rules broadly in line with European standards. The recent changes under the Data (Use and Access) Act[1] were watched closely for exactly this reason. The renewal is a vote of confidence, not a blank cheque.
For you, the practical message is simple: nothing breaks today, but the arrangement is reviewed, so keep your data protection house in order.
What this means for you
You do not need to do anything special to keep receiving EU data right now. Your existing arrangements continue.
What is worth doing is knowing where your data comes from and goes to. If you receive personal data from the EU, note it. If you send personal data outside the UK, that is a separate question with its own rules under the UK GDPR.[3]
A short record of your data flows is the single most useful thing a small business can keep. It answers the adequacy question, the complaints question, and most of the questions a regulator might ever ask.