Skip to main content

Adequacy decisions

How the EU determines if a non-EU country has an adequate level of data protection.

The European Commission has the power to determine, on the basis of article 45 of Regulation (EU) 2016/679 whether a country outside the EU offers an adequate level of data protection.

The adoption of an adequacy decision involves:

  • a proposal from the European Commission;
  • an opinion of the European Data Protection Board;
  • an approval from representatives of EU countries;
  • the adoption of the decision by the European Commission.

At any time, the European Parliament and the Council may request the European Commission to maintain, amend or withdraw the adequacy decision on the grounds that its act exceeds the implementing powers provided for in the regulation.

The effect of such a decision is that personal data can flow from the EU (and Norway, Liechtenstein and Iceland) to that third country without any further safeguard being necessary. In others words, transfers to the country in question will be assimilated to intra-EU transmissions of data.

The European Commission has so far recognised Andorra, Argentina, Canada (commercial organisations), Faroe Islands, Guernsey, Israel, Isle of Man, Japan, Jersey, New ZealandRepublic of KoreaSwitzerland , the United Kingdom under the GDPR and the LED, the United States (commercial organisations participating in the EU-US Data Privacy Framework)  and Uruguay as providing adequate protection.

With the exception of the United Kingdom, these adequacy decisions do not cover data exchanges in the law enforcement sector which are governed by the Law Enforcement Directive (Article 36 of Directive (EU) 2016/680).

Documents

10 JULY 2023
Adequacy decision for the EU-US Data Privacy Framework
English
(2.75 MB - PDF)
Download
4 APRIL 2023
Report on the first periodic review of the adequacy decision for Japan
English
(162.83 KB - HTML)
Download
4 APRIL 2023
Commission Staff Working Document - Report on the first periodic review of the adequacy decision for Japan
English
(314.01 KB - HTML)
Download
17 DECEMBER 2021
Decision on the adequate protection of personal data by the Republic of Korea with annexes
English
(1.69 MB - HTML)
Download
28 JUNE 2021
Decision on the adequate protection of personal data by the United Kingdom - General Data Protection Regulation
English
(900.31 KB - HTML)
Download
28 JUNE 2021
Decision on the adequate protection of personal data by the United Kingdom: Law Enforcement Directive
English
(600.68 KB - HTML)
Download
14 JANUARY 2019
EU Japan Adequacy Decision - Factsheet
English
(216.41 KB - PDF)
Download