Transfers on the basis of an adequacy decision

Personal data can be transferred out of the European Union and European Economic Area if the European Commission has issued a decision on an adequate level of protection for personal data (‘adequacy decision’, Article 45 of the GDPR). A decision by the Commission takes priority over other bases for transfer. The decision can apply to a country outside the European Union or European Economic Area, a territory or sector within such a country, or an international organisation.

Personal data can be transferred directly by virtue of an adequacy decision. No specific authorisation, such as from the Data Protection Ombudsman, is required. Such transfers must nevertheless comply with all provisions of the applicable data protection legislation. The processing of personal data must be lawful before, during and after the transfer.

The Commission reviews adequacy decisions at least every four years. As a rule, decisions made by the Commission before the entry into force of the GDPR remain valid also after the adoption of the Regulation. However, the Commission is free to review these decisions and make new ones as required.

To date, the Commission has issued adequacy decisions for the following countries (links lead to the EUR-Lex web service):

Andorra, Argentina, the Faroe Islands, Guernsey, Israel, the Isle of Man, Japan, Jersey, New Zealand, Republic of Korea, ​​​​​​​Switzerland, UK and Uruguay.

Furthermore, the Commission has issued a partial adequacy decision for Canada (commercial organisations).

An up-to-date list of adequacy decisions and other current information is available from the Commission's website

Adequacy decisions made under the GDPR are not applicable to the transfers of data within the scope of application of the Law Enforcement Directive, and with the exception of the United Kingdom, no adequacy decisions under the Law Enforcement Directive have been made yet. Other transfer instruments in accordance with the Finnish Act on the Processing of Personal Data in Criminal Matters and in Connection with Maintaining National Security must be used for transfers to third countries.

EU-U.S. Data Privacy Framework

On 10 July 2023, the European Commission adopted its adequacy decision for the EU-U.S. Data Privacy Framework. The adequacy decision permits the transfer of data from the EU and EEA to participating companies in the US without additional safeguards.

The adequacy decision applies to transfers of personal data made to US companies that have committed to the safeguards specified in the arrangement. The adequacy decision cannot be used as an instrument for the transfer of personal data between public sector entities.

Adequacy decision for the EU-US Data Privacy Framework (on the commission’s website)

Frequently asked questions regarding the adequacy decision concerning data protection in the US

Questions & Answers: EU-US Data Privacy Framework (on the commission’s website)

List of certified organisations committed to the adequacy decision (website under the Federal Trade Commission)

Frequently asked questions regarding the adequacy decision concerning data protection in the United States