Trade relies on the free flow of personal data across borders. International data transfers are crucial to many areas of the UK economy including financial services, hospitality and retail. Nowadays it is impossible to do business without processing personal data, from sending an email to a business contact, to putting your customer details on the cloud, to developing new technologies. Processing personal data is part of what all organisations do, from SMEs to large corporations. The International Chamber of Commerce’s research into the value of data flows found that they would be worth $11trillion to the global economy in 2025 and exceed the value of the global trade in goods. Given that the EU is the UK’s biggest trading partner, the free flow of data between the EU and the UK is vital to UK businesses.

Currently, there is a free flow of data from the EU to the UK for both general and law enforcement data processing. This is because the EU has assessed the UK’s frameworks as providing an essentially equivalent level of protection of personal data to that in the EU. The assessment of essential equivalence is set out in an “adequacy decision”. The basis for this assessment is that the UK’s current data protection regime (the UK GDPR and the Data Protection Act 2018) mirrors the standards set out in the EU’s data protection frameworks. The foundations of both the UK and EU data protection regimes are the ECHR and the Council of Europe’s Data Protection Convention 1081. The EU adequacy decisions for the UK explicitly state that the UK’s adherence to the ECHR, Convention 108 and the acceptance of the jurisdiction of the European Court of Human Rights are key aspects of the adequacy finding2. UK withdrawal from the ECHR and the Council of Europe therefore risks the loss of the UK’s adequacy decisions because the foundational principles of the UK data protection regime (which it shares with the EU) would be removed. A loss of adequacy would lead to the cessation of the free flow of data between the EU and the UK. This would have serious consequences for both commercial and law enforcement data sharing.

The loss of the free flow of personal data from the EU to the UK could cost UK business up to £1.6bn in additional compliance costs according to a UCL and New Economics Foundation study. The House of Lords’ European Affairs Committee has published evidence of further problems which would arise from a data ‘inadequacy’ finding, including: difficulties in operating international payments systems, dealing with cross-border family cases, international collaboration to tackle money-laundering and cybercrime, medical research and treatment. Losses to the NHS could amount to tens of millions of pounds3. Law enforcement cooperation under Part 3 of the UK-EU Trade and Cooperation Agreement would also become “very difficult”4. Further, the loss of the free flow of data would potentially violate the “no diminution of rights” commitment under Article 2 of the Ireland/Northern Ireland Protocol to the EU/UK Withdrawal Agreement.

Eleonor Duhs, Partner and Head of Data & Privacy, Bates Wells

4 November 2025

  1. See for example the case RMT v Bonne Terre Ltd & Anor [2025] EWHC (KB) (23 January 2025) at [100], where Collins Rice J explains that the UK’s data protection framework is “ultimately derived from Art.8 ECHR”. See also Article 4(28) of the UK GDPR which clarifies that references to fundamental rights or fundamental freedoms (however expressed) in the UK GDPR refer to rights in the ECHR as implemented through the Human Rights Act 1998. There are numerous such references throughout the legislation. ↩︎
  2. See for example recital 19 to the UK’s current adequacy decision which cites the UK’s adherence to the ECHR, Convention 108 and the jurisdiction of the European Court of Human Rights as key to the adequacy finding. The Decision states: “These obligations arising from legally binding international instruments, concerning notably the protection of personal data, are therefore a particular important element of the legal framework assessed in this Decision”. The Council of Europe in Strasbourg, is of course an entirely different body to the European Union in Brussels, from which the UK exited. However the foundations of both the UK and the EU regime are the ECHR and Council of Europe Convention 108.  ↩︎
  3. See the evidence cited at paragraph 6 of Appendix B. ↩︎
  4. See the evidence cited at paragraph 8 of Appendix B. ↩︎