UK Data Adequacy and Pharmacovigilance Requirements

The BHBIA Ethics & Compliance Committee highlights two recent EU developments with potential implications for UK healthcare business insights professionals.

EDPB issues Opinions on EU Commission’s UK draft adequacy decisions

On October 20, 2025, the European Data Protection Board (EDPB) adopted two opinions on the European Commission’s draft decisions to extend the validity of the UK’s adequacy status under the EU General Data Protection Regulation (EU GDPR) and the Law Enforcement Directive (LED) until December 2031. The existing decisions are set to expire on December 27, 2025. When considering the UK’s adequacy status, the European Commission and EDPB must take into consideration the recently passed UK Data (Use and Access) Act 2025.

The EDPB expressed general approval of the UK’s continued efforts to mirror the EU’s data protection standards, noting that the majority of proposed amendments to the UK data protection regime are designed to enhance clarity and support compliance for both organisations and individuals. 

The extension of the validity of the UK adequacy decisions will allow organisations and competent authorities based in Europe to continue transferring data to UK-based organisations and authorities without implementing additional guarantees.

For more details, visit: Draft UK adequacy decisions: EDPB adopts opinions | European Data Protection Board

Regulation (EU) 2025/1466

This EU Regulation is coming into force, with most requirements becoming effective on 12 February 2026.  The Regulation is aimed at marketing authorisation holders (MAHs) (i.e. pharma companies) and their pharmacovigilance (PV) systems, but third parties subcontracted to perform PV tasks (including market research agencies) may be impacted.

 Key requirements relate to:

• Strengthened subcontracting requirements:
• Contracts must define roles/responsibilities, data exchange with the MAH and audit/inspection rights.
• Further subcontracting by third parties requires the MAH’s written approval.
• Enhanced audit obligations: third parties must accept audits by or on behalf of the MAH and may be subject to inspections by regulators.

 For more details, visit: Implementing regulation - EU - 2025/1466 - EN - EUR-Lex

The BHBIA’s Ethics & Compliance Committee provides guidance as general information for its members. It is not legal advice and should not be relied upon as such. Specific legal advice should be taken in relation to any specific legal problems or matters. Whilst every reasonable effort is made to ensure the information is accurate, no responsibility for its accuracy or for any consequences of relying on it is assumed by the BHBIA.