Adequacy Decision

What is an adequacy decision?

An adequacy decision is a finding by the European Commission that a country outside the EU protects personal data to a standard the EU accepts. Under GDPR Article 45, personal data can then go there without "any specific authorisation." The Commission says such transfers are treated like transfers within the EU, and they also cover data leaving Norway, Liechtenstein and Iceland.

Without one, a transfer needs another tool, such as standard contractual clauses (SCCs) or binding corporate rules, plus a check of the destination's laws.

How it works

• The test: the Commission looks at the rule of law, including public authorities' access to personal data, whether there is an independent regulator with enforcement powers, and the country's international commitments.
• The scope: a decision can cover a whole country, a territory, specific sectors or an international organization.
• Reviews: each decision must be reviewed at least every four years, and the Commission can repeal, amend or suspend it if protection drops.

Who has one, as of October 2026

The Commission's adequacy list covers Andorra, Argentina, Brazil, Canada (commercial organizations only), the Faroe Islands, Guernsey, Israel, the Isle of Man, Japan, Jersey, New Zealand, South Korea, Switzerland, the UK, the US (only companies in the EU-US Data Privacy Framework), Uruguay and the European Patent Organisation.

Recent changes: the European Patent Organisation was added on 15 July 2025, the UK decisions were renewed on 19 December 2025, Brazil's was adopted on 27 January 2026, and the first review of South Korea's ended on 23 July 2026 with a finding that it continues to provide adequate protection.

Decisions can fall. The EU Court of Justice struck down two earlier US decisions, Safe Harbour in 2015 and Privacy Shield in 2020 (Schrems II). The current US decision, adopted on 10 July 2023, survived a challenge at the EU General Court on 3 September 2025. The challenger appealed to the Court of Justice on 31 October 2025 (Case C-703/25 P), and as of October 2026 the appeal was pending.

What it looks like in a vendor's terms

A typical transfer clause in a vendor DPA reads like this:

Vendor will transfer Customer Personal Data outside the EEA only to a country that the European Commission has found to provide an adequate level of protection, or under the Standard Contractual Clauses. If an adequacy decision that Vendor relies on is invalidated, the Standard Contractual Clauses will apply to the affected transfers.

• "Adequate level of protection": the Article 45 list. The vendor can route data to any country on it without more paperwork.
• "Or under the Standard Contractual Clauses": the tool for every other country.
• "If ... invalidated": a fallback. After two US decisions were struck down, it is worth having.

Why it matters to you

An adequacy decision is the simplest way for your data to leave the EU. But it only answers the transfer question. Article 28 still requires a contract with each processor, so you still need a DPA. And the scope matters: a US vendor without Data Privacy Framework certification is not covered.

When a vendor adds a subprocessor in a country that is not on the list, the transfer needs SCCs and a transfer impact assessment instead.

What to check

• Destinations: Where each vendor and its subprocessors process your data, matched against the Commission's list.
• Partial decisions: For US vendors, current Data Privacy Framework certification; for Canada, that the recipient is a commercial organization.
• Fallback: Whether the DPA switches to SCCs if an adequacy decision is lost.
• UK data: The UK makes its own adequacy findings, so check UK transfers against the UK list, not the EU one.

How Venpo helps

Venpo watches your vendors' subprocessor lists, DPAs and privacy policies and emails a plain-English alert when one changes, such as a new subprocessor in another country or a DPA that drops a transfer tool. The Fine Print Scan answers, per vendor, whether your data goes to China or other restricted countries and how many companies have it.