Authored By: Nombuso Precious Mkhize
University of South Africa
On 19 December 2025, the European Commission renewed the UK’s data adequacy status, securing free data flows from the EU until 27 December 2031. Barely seven weeks later, on 5 February 2026, the UK activated a novel standalone lawful basis for processing personal data – the recognised legitimate interest which bypasses the balancing test otherwise required under UK GDPR and has no direct equivalent in EU law.
This legal standard was established by the Court of Justice of the European Union (CJEU) in the landmark Schrems I and Schrems II judgements. It dictates that while a non-EU country’s laws do not need to be a point-point replica of EU law, they must be essentially equivalent in practice at safeguarding fundamental rights.
While the UK’s domestic implementation of the RLI poses a reduction in procedural safeguards for individual rights, the far greater structural risk to its EU data adequacy status stems from its international onward transfer reforms, which abandon the strict essential equivalence standard for a loose ‘not materially lower’ test. By lowering its data transfer standards, the UK risks acting as an open back door that channels EU data into countries the EU itself considers unsafe.
This article begins by examining the RLI, focusing on its specific and contained risk to adequacy. It then turns to the UK’s revised international transfer test, and argues that it poses the greater structural risk to adequacy. Finally, it recommends that the UK tighten the “not materially lower” test in practice, so as not to drift from essential equivalence.
Recognised Legitimate Interests: A Contained Departure
The introduction of Article 6(1)(e) and the new Annex 1 into the UK GDPR marks a notable procedural shift in British data privacy law. Introduced by section 70 and schedule 4 of the Data (Use and Access) Act 2025, and in force since 5 February 2026, this mechanism establishes a “recognised legitimate interest” (RLI) framework that bypasses the traditional balancing test required under standard legitimate interests. For five specific public-interest categories – crime prevention and detention, safeguarding vulnerable individuals, emergency responses, national security and defence, and disclosures to public bodies performing a public benefit inherently outweighs an individual’s data subject rights. Consequently, data controllers relying on this basis do not need to conduct a subjective weighing exercise; they must simply demonstrate that the data processing is strictly necessary to achieve one of these predefined, high-priority objectives.
The Recognised Legitimate Interests (RLI) framework creates a notable point of friction with the EU’s strict adequacy standards. While the UK views this shift as an administrative efficiency, removing the individualised check constitutes a genuine, if narrow, gap in the standard of protection. Under Article 45 and Recital 104 of the EU GDPR, a third country must maintain an “essentially equivalent” level of data protection. Crucially, the EU GDPR contains no equivalent “no-balancing-test” category; Article 6(1)(f) mandates a case-by-case balancing exercise for every activity without exception. The CJEU holds that context-specific risk assessment is essential to prevent privacy regulations from becoming a superficial, formalistic exercise. This individualised check ensures that data protection serves as substantive protection rather than merely a box-ticking requirement – a safeguard the UK framework bypasses through statutory pre-determination.
Crucially, the RLI framework does not grant data controllers a blanket exemption from compliance. Organisations relying on a recognised legitimate interest remain strictly bound by all other core UK GDPR principles, including data minimisation, purpose limitation, and the threshold requirement of necessity. Furthermore, the five initial categories largely track objectives that the EU GDPR recitals already recognise as strong legitimate interests, meaning the substantive processing tolerated under UK law does not radically depart from European norms. Instead, the primary regulatory vulnerability lies in the fact that Annex 1 is dynamic. The Secretary of State retains the statutory power to expand this list of categories over time without triggering an automatic adequacy review, meaning today’s narrow scope is not a permanent guarantee. It is this capacity for silent legislative expansion, rather than the initial baseline, that connects the RLI framework to the more serious structural risks examined in the next section.
The International Transfer Test: A Structural Threat
The Data (Use and Access) Act 2025 further explains reshapes international data transfers by replacing the traditional “essentially equivalent” threshold with a new “data protection test” in force since 5 February 2026. Under this standard, third-country protection must simply be “not materially lower” than UK standards. This test applies in two critical circumstances: when the Secretary of State makes an adequacy-style decision regarding a third country, and when a controller conducts a transfer risk assessment relying on appropriate safeguards such as Standard Contractual Clauses. Crucially, the reform permits the Secretary of State to weigh external policy-driven matters, including the explicit desirability of facilitating transfers. The UK has significantly shifted how it judges whether another country is “safe” for data transfers, now allowing economic considerations into a decision that used to be based purely on rights.
This shift changes the substantive yardstick governing UK onward transfers, representing a difference in kind rather than a mere procedural tweak like the RLI framework. Under Article 45 of the EU GDPR and the Schrems II jurisprudence, the EU demands an “essentially equivalent” standard that leaves no room for built-in flexibility or political compromise explicitly alternative regulatory models as long as the practical outcomes are not demonstrably worse. However data protection commentators have noted that it remains unclear how far the two standards will diverge in practice it introduces systemic legal uncertainty into the international data ecosystem. Because of this change, all future safety checks will use lower bar, creating a permanent, lasting split from the EU’s strict privacy approach.
The operational consequence of this lower threshold creates a critical vulnerability regarding onward data transfers. If the UK approves third countries or individual transfers under the more flexible “not materially lower” bar, EU-originated personal data could flow through the UK and terminate in a jurisdiction that the European Commission would never have approved directly. This precisely the type of structural onward-transfer risk that the EU is legally mandated to monitor continuously under its own periodic review of the UK’s adequacy status. Crucially, while the RLI framework is contained to five defined categories, this reform modifies the legal baseline for every future UK decision to export data globally and indefinitely. Because of this sweeping scope, the potential for the UK regime to accumulate regulatory friction by the next EU review cycle is far greater, transforming a theoretical divergence into a substantive threat to cross-border data flows.
Conclusion
In conclusion, the dual reforms introduced by the Data (Use and Access) Act 2025 create a tiered, escalating challenge to the UK’s data protection standing. While the Recognised Legitimate Interest (RLI) framework introduces a narrow, procedurally contained departure by removing the case-by-case balancing test for five public-interest categories, it is the “not materially lower” data protection test that poses the deeper structural threat by altering the substance yardstick for all onward data transfers, this international test injects systemic regulatory ambiguity and introduces a far greater risk of unvetted global data flows. Together, these measures shift the UK from an uncompromising rights-based alignment toward a more commerce-orientated framework, meaning that the UK’s ongoing adequacy status is no longer a permanent guarantee. To mitigate this friction and avoid drifting fatally from the EU’s “essential equivalence” baseline, the UK government must apply the “not materially lower” test strictly and narrowly in practice. Only by exercising theses new legislative mechanisms narrowly and consistently can the UK preserve the free flow of personal data between the UK and the EU.
Reference(S):
Primary Sources
Data (Use and Access) Act 2025
Regulation (EU) 2016/679 (General Data Protection Regulation) [2016] OJ L119/1 Case C-362/14 Maximillian Schrems v Data Protection Commissioner EU:C:2015:650
Case C-311/18 Data Protection Commissioner v Facebook Ireland Ltd and Maximillian Schrems EU:C:2020:559
European Commission, Commission Implementing Decision on the adequate protection of personal data by the United Kingdom under Regulation (EU) 2016/679 (19 December 2025) OJ L 2025/2574
Secondary Sources
Clifford Chance, ‘Key aspects of the Data (Use and Access) Act take effect’ (Talking Tech blog, February 2026)
Burges Salmon, The Data (Use and Access) Act 2025: Key Implications for Businesses as the New International Transfer Regime Takes Effect’ (2026)
Information Commissioner’s Office, The Data (Use and Access) Act 2025 (DUAA) – what does it mean for organisations?’(ico.org.uk)
