Adequacy decision

What it means

An adequacy decision is a European Commission decision that a non-EU country ensures an adequate level of personal data protection. Data can be transferred there without further safeguards, as if within the EU. It is the simplest legal basis for an international data transfer.

In its assessment, the Commission examines the country's legal framework, the existence of an independent supervisory authority, data subjects' rights and public authorities' access to data. Decisions exist, for example, for the United Kingdom, Switzerland, Japan, the Republic of Korea and several other countries.

For the United States a special regime applies, the EU-US Data Privacy Framework, which covers only US companies certified under it. For uncertified recipients in the US, other tools are needed, such as standard contractual clauses.

How it works in practice

Before using a foreign cloud service, marketing tool or accounting software, find out where the data are processed. If the country has an adequacy decision, the transfer is straightforward; otherwise contractual safeguards and a risk assessment are required.

Information about transfers to third countries and their legal basis belongs in the record of processing activities and in the information given to data subjects. In an inspection, the company must be able to show where data flow and on what basis.

Many providers use sub-processors in various countries. The processing agreement should list the sub-processors and their locations and require notice of changes, so the company can react if data start flowing to a country without adequate protection.

What to watch out for

Adequacy decisions can change or be annulled. The EU Court of Justice struck down two earlier frameworks for transfers to the US, catching thousands of companies off guard. Keep an eye on developments and have a fallback legal basis ready.

An adequacy decision only addresses the lawfulness of the transfer, not other obligations. The company must still follow all GDPR principles, have a lawful basis for processing and a processing agreement, whatever the country.