Adequacy decision
An adequacy decision is a European Commission decision that a non-EU country, territory or framework provides an essentially equivalent level of data protection, so personal data can flow there without further safeguards.Article 45 of the GDPR lets the Commission decide that a third country ensures an adequate level of protection, after assessing its rule of law, its data protection rules, its oversight and the redress available to Europeans. Transfers to an adequate destination need no standard contractual clauses and no transfer impact assessment. Decisions are reviewed periodically and can be suspended or annulled; the Court of Justice struck down two US frameworks, Safe Harbor in 2015 and Privacy Shield in 2020.
The Commission currently recognizes Andorra, Argentina, Canada (for commercial organizations), the Faroe Islands, Guernsey, the Isle of Man, Israel, Japan, Jersey, New Zealand, the Republic of Korea, Switzerland, the United Kingdom, Uruguay, and the United States for companies certified under the EU-US Data Privacy Framework (decision of 10 July 2023). The two UK decisions, adopted in 2021, were renewed on 19 December 2025 for six years, until 27 December 2031, after the Data (Use and Access) Act 2025 was assessed. The UK in turn recognizes the EEA and the same list of countries under its own rules, and Switzerland maintains a comparable list.
For a website, adequacy decides how much paperwork a vendor needs: a US analytics or advertising provider certified under the Data Privacy Framework can be used on the basis of adequacy, while a non-certified one needs the clauses. See the UK GDPR and PECR page for the UK side.