An adequacy decision is a finding by the European Commission that a non-EU country gives personal data an adequate level of protection. Data can then flow there from the EU without extra transfer safeguards. The Commission publishes the list of covered countries and keeps it updated, so check it on the day you rely on it.
What the Commission looks at
Article 45 lists the factors. They fall into three groups:
- The legal framework: rule of law, human rights, public and national security law, government access to data, onward transfer rules, enforceable rights and redress.
- Independent oversight: a working supervisory authority with enforcement powers.
- International commitments: treaties and participation in regional or multilateral systems on data protection.
A decision must include a review mechanism at least every four years and must state its territorial and sectoral scope.
Who is on the list
According to the Commission's page when I fetched it, adequacy decisions cover Andorra, Argentina, Brazil, Canada (commercial organisations only), the Faroe Islands, Guernsey, Israel, the Isle of Man, Japan, Jersey, New Zealand, the Republic of Korea, Switzerland, Uruguay and the United Kingdom. The United States is covered for commercial organisations that take part in the EU US Data Privacy Framework. The European Patent Organisation is also listed.
Note the qualifiers. Canada is limited to commercial organisations. The US decision applies to participating organisations, not every US company. The page dates the Brazil decision to 26 January 2026 and says the UK decisions were renewed in December 2025.
What adequacy does not do
It does not remove your other GDPR duties. You still need a lawful basis, a processor contract where relevant, security measures and honest privacy notices. It only removes the extra transfer step.
It can also change. Under Article 45(5) the Commission can repeal, amend or suspend a decision if a country stops giving adequate protection, with effect that is not retroactive.
A practical routine
- For each foreign destination, record whether an adequacy decision covers it and what its scope is.
- For the US, record whether the recipient is a participant and the date you checked.
- For anything outside the list, record the safeguard instead, such as standard clauses.
- Re-check on a schedule and whenever you add a vendor.
See EU to US data transfers and GDPR safeguards for the options when no adequacy decision applies.
Quick check
Does adequacy cover law enforcement data?
Per the Commission's page, except for the UK these decisions do not cover law enforcement data, which falls under a separate directive.
Is the list static?
No. It changes as decisions are adopted, reviewed or repealed. Re-check before each reliance.
Sources
Last reviewed: 19 October 2026.
