An adequacy decision is a formal implementing decision of the European Commission under Article 45 of the GDPR stating that a country outside the European Economic Area, a territory, a specific sector within a country or an international organization ensures an adequate level of protection for personal data. Once such a decision is in force, personal data can flow from the EEA to that destination without any further authorization or additional transfer safeguards.
In privacy practice, adequacy is the most convenient legal route for international data transfers. It treats the recipient country almost like another member state for transfer purposes, although every other GDPR obligation, such as a valid legal basis, purpose limitation and transparency, still applies to the processing itself.
How the adequacy assessment works
The legal test is not identical law but essential equivalence. The Court of Justice of the European Union set this benchmark in the 2015 Schrems ruling: the foreign system must deliver protection essentially equivalent to that guaranteed in the Union, even if it uses different means to achieve it.
Article 45(2) lists the elements the Commission must examine. The table below summarizes them and what each one means in practice.
| Element | What is examined | Why it matters |
|---|---|---|
| Rule of law and rights | Respect for human rights and fundamental freedoms | Protection must be enforceable, not only written |
| Data protection rules | Principles, data subject rights, onward transfer rules | Core safeguards must match GDPR substance |
| Government access | Surveillance, national security and law enforcement powers | Main reason earlier decisions were annulled |
| Independent supervision | An authority with real enforcement powers | Individuals need someone to complain to |
| Redress | Effective administrative and judicial remedies | Rights without remedies are not adequate |
| International commitments | Treaties such as Convention 108 | Shows a durable commitment to data protection |
The adoption procedure has several stages. The Commission prepares a draft, the European Data Protection Board issues a non-binding opinion, a committee of member state representatives approves it under the comitology procedure, and the College of Commissioners adopts the final decision. The European Parliament and the Council may scrutinize the text but do not vote on it.
Scope, duration and review of an adequacy decision
An adequacy decision can cover a whole country, a specific sector or a defined group of recipients. The decision for Canada, for example, applies to commercial organizations subject to its federal private-sector privacy law, and the arrangement for the United States covers only organizations that self-certify under the EU-U.S. Data Privacy Framework.
Decisions are not permanent. The GDPR requires a periodic review at least every four years, and the Commission must monitor developments continuously. It can amend, suspend or repeal a decision if the level of protection falls, and the decisions for the United Kingdom were the first to contain a sunset clause that made them expire unless renewed. Decisions adopted under the former Data Protection Directive remain in force until amended or repealed.
The following table shows the main types of coverage with representative destinations.
| Coverage type | Representative destinations | Practical consequence |
|---|---|---|
| Full country | Japan, Switzerland, New Zealand, Republic of Korea | Any recipient in the country qualifies |
| Sectoral | Canada, commercial organizations | Check that the recipient falls within the sector |
| Certification-based | United States, Data Privacy Framework | Verify the recipient is actively certified |
| With sunset clause | United Kingdom | Monitor renewal dates and review outcomes |
Adequacy compared with other transfer mechanisms
Chapter V of the GDPR creates a hierarchy of transfer tools. Adequacy comes first; when it is absent, exporters must use appropriate safeguards under Article 46, and only in limited cases may they rely on the derogations of Article 49. Neighboring mechanisms each carry a different compliance burden.
| Mechanism | Legal basis | Effort for the exporter |
|---|---|---|
| Adequacy decision | Article 45 | Lowest; no extra contract or assessment |
| SCC | Article 46(2)(c) | Contract plus a transfer impact assessment |
| Binding corporate rules | Article 47 | High; approval by supervisory authorities |
| Codes and certifications | Article 46(2)(e) and (f) | Moderate; binding commitments by the importer |
| Derogations | Article 49 | Narrow, occasional and strictly interpreted |
The decisive difference is that a transfer under adequacy does not require a transfer impact assessment. When exporters use SCC, they must evaluate the law of the destination themselves, while an adequacy decision means the Commission has already carried out that evaluation for everyone.
Invalidation risk and the Schrems rulings
An adequacy decision is only as stable as its legal foundation. National courts cannot declare it invalid, but they can refer questions to the Court of Justice, which has annulled transatlantic arrangements twice because of concerns about government surveillance and redress.
- Safe Harbor was invalidated in 2015 in the first Schrems case.
- Privacy Shield was invalidated in 2020 in the second Schrems case.
- The EU-U.S. Data Privacy Framework was adopted in 2023 after new U.S. limits on signals intelligence and a new redress mechanism.
For organizations, this history means contingency planning is prudent. Many exporters to the United States keep SCC in their contracts as a fallback, so that transfers can continue with minimal disruption if the current framework is ever struck down.
Practical checks and common mistakes
Relying on adequacy is simple, but it still requires documented verification. The record of processing activities should state the destination and the adequacy decision relied on, and privacy notices must inform data subjects about transfers to third countries.
| Mistake | Consequence | Correct approach |
|---|---|---|
| Assuming all U.S. recipients qualify | Unlawful transfer to non-certified importers | Check the Data Privacy Framework list |
| Ignoring onward transfers | Data leaves the adequate destination unprotected | Contract for onward transfer safeguards |
| Treating adequacy as a legal basis | Processing itself may still be unlawful | Keep a valid Article 6 basis |
| Forgetting sector limits | Recipient outside the covered sector | Confirm the recipient type and law |
| Not tracking reviews or rulings | Reliance on a repealed decision | Monitor Commission and court updates |
In everyday language
An adequacy decision is like a trusted country stamp issued by the European Union. The European Commission studies another country’s privacy laws, its courts and how its government may access data. If the protection is close enough to European standards, it declares that country safe.
After that, companies in Europe can send personal information there almost as easily as to another European country. No extra contracts or risk studies are needed for the transfer itself. The stamp can be withdrawn, however, if the country weakens its protections or a court finds the assessment was wrong.
Seen in the real world
A German online retailer wants to move its customer support system to a provider based in Japan. Because Japan benefits from an adequacy decision, the retailer’s data protection officer confirms that the provider falls within the scope of the decision, records the transfer in the record of processing activities and updates the privacy notice.
The same retailer also plans to use an analytics vendor in the United States. Here the officer first checks whether the vendor is actively certified under the Data Privacy Framework. It is, so adequacy covers the transfer, but the retailer still keeps standard contractual clauses in the contract as a fallback. The result is lawful transfers to both countries with far less paperwork than a full transfer impact assessment would require.