An adequacy decision is a formal finding by the European Commission. It says that a country outside the EU has data protection standards similar to GDPR is the EU's main data protection law. It gives Europeans rights over their personal data and sets strict rules for companies that handle it. Learn more → . Once a country has adequacy status, companies can send European data there without extra legal steps. The UK, Japan and South Korea have adequacy decisions. The US does not have a general one, which is why EU-US transfers rely on other tools, like the The EU-US Data Privacy Framework is the current agreement that lets data flow from Europe to US companies that sign up to it. Learn more → .
Frequently asked questions
What is an adequacy decision under GDPR?
An adequacy decision is an official decision by the European Commission. It says a country outside the EU protects personal data well enough. The standard is close to GDPR's own rules.
Once a country has this status, companies can send EU data there more easily. They don't need extra contracts or safeguards for each transfer. The adequacy decision covers the whole country at once.
Which countries currently have an EU adequacy decision?
Several countries have adequacy decisions from the EU. Examples include the United Kingdom, Japan, South Korea, Canada, and Switzerland. Each decision covers a specific country, sometimes with limits on which sectors count.
The European Commission reviews these decisions regularly. A country can gain adequacy status. It can also lose it, if its data protection rules change or weaken. So the list is not fixed forever.
Does the United States have an adequacy decision?
Not a general one. The US does not have a single adequacy decision covering all data transfers, the way the UK or Japan does. Instead, EU-US data transfers rely on a narrower tool.
That tool is the EU-US Data Privacy Framework. It works more like a certification program. Only US companies that sign up and meet its rules can receive EU data under it. Companies outside the framework need a different legal basis.
How long does an adequacy decision last before it's reviewed?
An adequacy decision doesn't expire on a fixed date. But it isn't permanent either. The European Commission must review each one at least every four years.
The Commission can also review a decision earlier if something changes. A new law in that country, or a court ruling, can trigger an early review. If the country no longer meets the standard, the Commission can withdraw the decision.