Transfers on the basis of an adequacy decision
Personal data can be transferred out of the European Union and European Economic Area if the European Commission has issued a decision on an adequate level of protection for personal data (‘adequacy decision’, Article 45 of the GDPR). A decision by the Commission takes priority over other bases for transfer. The decision can apply to a country outside the European Union or European Economic Area, a territory or sector within such a country, or an international organisation.
Personal data can be transferred directly by virtue of an adequacy decision. No specific authorisation, such as from the Data Protection Ombudsman, is required. Such transfers must nevertheless comply with all provisions of the applicable data protection legislation. The processing of personal data must be lawful before, during and after the transfer.
The Commission reviews adequacy decisions at least every four years. As a rule, decisions made by the Commission before the entry into force of the GDPR remain valid also after the adoption of the Regulation. However, the Commission is free to review these decisions and make new ones as required.
To date, the Commission has issued adequacy decisions for the following countries (links lead to the EUR-Lex web service):
Andorra, Argentina, the Faroe Islands, Guernsey, Israel, the Isle of Man, Japan, Jersey, New Zealand, Republic of Korea, Switzerland, UK and Uruguay.
Furthermore, the Commission has issued a partial adequacy decision for Canada (commercial organisations).
Adequacy decisions made under the GDPR are not applicable to the transfers of data within the scope of application of the Law Enforcement Directive, and with the exception of the United Kingdom, no adequacy decisions under the Law Enforcement Directive have been made yet. Other transfer instruments in accordance with the Finnish Act on the Processing of Personal Data in Criminal Matters and in Connection with Maintaining National Security must be used for transfers to third countries.
EU-U.S. Data Privacy Framework
On 10 July 2023, the European Commission adopted its adequacy decision for the EU-U.S. Data Privacy Framework. The adequacy decision permits the transfer of data from the EU and EEA to participating companies in the US without additional safeguards.
The adequacy decision applies to transfers of personal data made to US companies that have committed to the safeguards specified in the arrangement. The adequacy decision cannot be used as an instrument for the transfer of personal data between public sector entities.
The EU-U.S. Data Privacy Framework replaces the Privacy Shield arrangement annulled by the so called Schrems II judgment (C-311/18) in July 2020. The Court of Justice found the decision concerning the adequacy of the personal data protection provided by the Privacy Shield arrangement to be invalid, because interference with fundamental rights in transfers of personal data to the United States has not been restricted in a manner that would essentially correspond to EU requirements.
The European Commission and the United States came to an agreement in March 2022 on the creation of a new data protection framework between the EU and the United States. The letter of intent on the Data Privacy Framework was implemented in US legislation by an Executive Order and a supplementary regulation concerning the court of appeal.
The EDPB issued its statement on the draft adequacy decision in March 2023.
Adequacy decision for the EU-US Data Privacy Framework (on the commission’s website)
Questions & Answers: EU-US Data Privacy Framework (on the commission’s website)
Frequently Asked Questions on the Schrems II judgment (on the EDPB's website)