Women in tech might have to cast their minds back, but in April 2024, the European Data Protection Board (EDPB) issued a statement supporting the European Commission’s draft implementing decision to extend the UK’s data adequacy status under Article 45(3) of the GDPR.
EDPB backs EC’s UK data adequacy decision extension: The procedural is significant
While this formal decision appeared to some to be merely procedural, its practical implications for data-driven sectors, particularly the UK tech industry– where women are key, are now shaping up to be significant.
In fact, for women working in technology, especially those operating within small and medium-sized enterprises (SMEs), startups, or as independent contractors, the decision could offer critical continuity and stability, writes Marina Danielyan of Gerrish Legal.
What is the UK’s Data Adequacy Decision?
Under the General Data Protection Regulation, personal data may only be transferred to a “third country” if the European Commission (EC) has determined that the country ensures an adequate level of data protection.
The UK received such a decision in 2021, following its departure from the EU, with a built-in sunset clause limiting the validity to four years. Unless extended, the adequacy decision would therefore lapse in July 2025.
Alternative Transfer Mechanisms be like…
An extension would mean the UK continues to benefit from unrestricted personal data transfers from the EU/EEA — without the need for alternative transfer mechanisms, such as:
- Standard Contractual Clauses (SCCs),
- Binding Corporate Rules (BCRs), or
- Supplementary Measures.
These three mechanisms, while effective, can place additional compliance burdens on organisations, especially those without in-house legal capacity.
To avoid disruption, the European Commission has therefore proposed a six-month extension.
In its “Opinion” of 06/2025, published March 5th 2025, the European Data Protection Board (EDPB) supported this temporary extension.
Top three tech areas that will thank the EDPB’s backing
While adequacy has broad implications for all data-reliant sectors, its impact is particularly acute in the tech industry.
Depending heavily on uninterrupted data flows between jurisdictions, are:
- Cloud Infrastructure,
- SaaS platforms,
- AI and machine learning models
Remote-first teams can celebrate EDPB supporting the six-month extension
To this trio reliant on uninterrupted data flows between jurisdictions, we can add a fourth — remote-first teams. These are something women in tech are invariably part of today or will be in the future.
Regulatory certainty for these four pillars of the tech industry area reduces risk exposure, and limits the need for bespoke legal solutions to facilitate cross-border processing.
Why it matters for women in tech
This is particularly important for women in tech, who, statistically and anecdotally, are better represented in freelance roles, hybrid positions, and early-stage startups.
Crucially, these are precisely the roles and entities least equipped to navigate sudden regulatory divergence or to absorb the costs of compliance (in the shape of transfer mechanisms like SCCs or Transfer Impact Assessments.)
In short, maintaining adequacy effectively removes a layer of operational and legal friction.
Gendered impacts in regulatory compliance
Although ‘adequacy’ is a gender-neutral instrument, its effects may be unevenly distributed when assessed through the lens of economic participation and access to legal resources.
Female tech professionals appear more likely, to us, to be in early-career roles or to lead or participate in resource-constrained startups where time and compliance capacity are limited.
In such environments, regulatory fragmentation disproportionately affects those without legal counsel or internal compliance infrastructure.
What would a loss of the UK’s adequacy mean for female data workers and techies?
The loss of ‘adequacy’ would force many to divert limited resources toward contractual and technical safeguards, ultimately reducing focus on innovation and product development.
Moreover, in data-centric fields such as artificial intelligence, data science, and cybersecurity, where women are still underrepresented, access to cross-border data sets is essential for model training, product testing, and analytics.
A stable legal basis for data transfers underpins much of this work.
Continued vigilance: UK divergence and the future of adequacy
The EDPB clarified that its Opinion does not amount to a reassessment of the UK’s data protection standards. Rather, it’s only a technical measure to give the EC time to evaluate upcoming changes to the UK’s legal framework (once they are finalised).
The EDPB also stressed that this extension should remain exceptional and should not be prolonged further.
Relevant here, the UK’s Data Protection and Digital Information (DPDI) bill, currently progressing through parliament, introduces reforms that may gradually distance the UK framework from the GDPR. While the EC’s draft decision affirms adequacy for now, any substantial regulatory divergence could prompt future reviews or even suspension.
What are the GDPR’s core principles we need preserved?
This uncertainty places continued pressure on UK regulators and policymakers to ensure that domestic reforms preserve the core principles of the GDPR, especially around:
- data subject rights;
- independent supervision, and;
- legal redress.
For organisations, the temporary nature of the extension underscores the importance of monitoring legal developments and maintaining compliance readiness for alternative transfer mechanisms, should ‘adequacy’ be withdrawn.
TLDR: Why EDPR’s backing of the UK's adequacy decision extension is welcome
The EDPB’s endorsement of the UK’s adequacy extension represents a welcome development for the UK technology sector.
For women working in tech, it offers a degree of regulatory continuity that supports cross-border collaboration, reduces legal and financial compliance burdens, and facilitates access to EU markets and data sets. For women in tech running budget-conscious start-ups, or who are watching their ‘bottom line’ as a freelance IT contractor, it might also keep costs down compared with what they might have been otherwise.
And finally, clarity, predictability, and maintenance…
Let me be clear — adequacy cannot solve structural challenges in the tech industry.
But, for now at least, it creates a more predictable legal environment — one that benefits not just large multinationals, but also the independent developers, data scientists, founders, and engineers working across borders in a sector where flexibility and agility are essential. Maintaining that environment will be crucial as the UK charts its data protection future.
Further reading for women in tech navigating regulatory change:
Marina Danielyan
Marina Danielyan is currently pursuing a Master’s degree in International and European Law, with a growing focus on the intersection of law, technology, and regulation. Alongside her academic work, she is building hands-on experience at Gerrish Legal, a digital law firm operating across Paris, London, and Stockholm. Marina’s interests span AI governance, platform accountability, data protection, and the future of EU tech regulation. Marina is particularly drawn to legal innovation and how technology can reshape not only the law itself, but how we access and understand it.
