Adequacy Decision
A determination by the European Commission that a country provides an adequate level of data protection for EU personal data transfers.
An adequacy decision is made by the European Commission under GDPR Article 45, determining that a third country, territory, or international organization ensures an adequate level of data protection. When an adequacy decision is in place, personal data can flow freely from the EU to that country without additional safeguards. The Commission assesses: the rule of law, respect for human rights, relevant legislation, the existence of an independent supervisory authority, and international commitments. Countries with adequacy decisions include: Andorra, Argentina, Canada (commercial), Faroe Islands, Guernsey, Israel, Isle of Man, Japan, Jersey, New Zealand, Republic of Korea, Switzerland, the UK, Uruguay, and the US (under the Data Privacy Framework).