The UK has finally been issued with an Adequacy Decision by the European Commission – confirmation that the UK’s data privacy laws provide an essentially equivalent level of protection to personal data as those in the EU, of which the UK is no longer a member. This is of huge importance to UK business – it has been estimated that the costs of no adequacy decision would have been £1.6 billion in compliance costs, let alone the indirect costs of disruption to data flows. So why has it taken so long? What were the EU’s concerns? And how have they been overcome (if indeed they have)? Is the US entitled to feel that double standards are being applied? What will Maximilian Schrems be making of all this? How will it end?