There is an adequacy decision for the country where my supplier is based. Do I still have to arrange anything for the transfer?

Not for the transfer itself: paragraph 1 says a transfer to a country with an adequacy decision requires no specific authorisation. All other rules of the GDPR still apply, such as the general principle in Article 44 and the obligations for the processing itself. Also check whether the decision covers the whole country or only a territory or sector, because paragraph 3 allows the scope to be limited.

How do I know which countries have an adequacy decision?

Under paragraph 8 the Commission publishes in the Official Journal of the European Union and on its website a list of countries, territories, sectors and international organisations for which it has decided that the level of protection is or is no longer adequate. Older decisions under the previous directive remain in force under paragraph 9 until the Commission amends, replaces or repeals them.

What happens if the Commission repeals an adequacy decision?

Under paragraph 5 the Commission may repeal, amend or suspend a decision if the country no longer ensures an adequate level of protection, without retroactive effect. Transfers to that country can then no longer be based on Article 45, but paragraph 7 leaves the other routes in Articles 46 to 49 untouched, such as transfers subject to appropriate safeguards (recital 107). The Commission also enters into consultations with the country to remedy the situation (paragraph 6).

Article 45: Transfers on the basis of an adequacy decision

Praxikon tracks Article 45 (Transfers on the basis of an adequacy decision) under the GDPR, alongside the EU AI Act, citing the source for every statement.

Chapter VIn force since 25-05-2018

Article 45 describes the first and simplest route for a transfer to a country outside the Union: the adequacy decision. Where the Commission has decided that a third country, a territory or sector within that country, or an international organisation ensures an adequate level of protection, you may transfer data there without any specific authorisation (paragraph 1). Paragraph 2 lists what the Commission weighs in that assessment: the rule of law and fundamental rights, the access of public authorities to data, the rights and remedies of data subjects, the existence of an independent supervisory authority and the country's international commitments (recitals 104 and 105); it consults the Board in doing so (recital 105). A decision is reviewed at least every four years (paragraph 3, recital 106), the Commission monitors developments on an ongoing basis (paragraph 4) and may repeal, amend or suspend a decision if the level of protection is no longer adequate (paragraph 5). The article exists to provide legal certainty and uniformity throughout the Union on which countries are considered safe (recital 103).

Key term: Adequacy decision: a Commission decision that a country outside the Union, a territory or sector within it, or an international organisation ensures an adequate level of protection, so that a transfer there requires no specific authorisation

Directly affects:CommissionBoardcontrollerprocessordata subject

Praxikon’s reading of the text and the recitals; the official text below prevails.

Official text

A transfer of personal data to a third country or an international organisation may take place where the Commission has decided that the third country, a territory or one or more specified sectors within that third country, or the international organisation in question ensures an adequate level of protection. Such a transfer shall not require any specific authorisation.

When assessing the adequacy of the level of protection, the Commission shall, in particular, take account of the following elements: (a) the rule of law, respect for human rights and fundamental freedoms, relevant legislation, both general and sectoral, including concerning public security, defence, national security and criminal law and the access of public authorities to personal data, as well as the implementation of such legislation, data protection rules, professional rules and security measures, including rules for the onward transfer of personal data to another third country or international organisation which are complied with in that country or international organisation, case-law, as well as effective and enforceable data subject rights and effective administrative and judicial redress for the data subjects whose personal data are being transferred; (b) the existence and effective functioning of one or more independent supervisory authorities in the third country or to which an international organisation is subject, with responsibility for ensuring and enforcing compliance with the data protection rules, including adequate enforcement powers, for assisting and advising the data subjects in exercising their rights and for cooperation with the supervisory authorities of the Member States; and (c) the international commitments the third country or international organisation concerned has entered into, or other obligations arising from legally binding conventions or instruments as well as from its participation in multilateral or regional systems, in particular in relation to the protection of personal data.

The Commission, after assessing the adequacy of the level of protection, may decide, by means of implementing act, that a third country, a territory or one or more specified sectors within a third country, or an international organisation ensures an adequate level of protection within the meaning of paragraph 2 of this Article. The implementing act shall provide for a mechanism for a periodic review, at least every four years, which shall take into account all relevant developments in the third country or international organisation. The implementing act shall specify its territorial and sectoral application and, where applicable, identify the supervisory authority or authorities referred to in point (b) of paragraph 2 of this Article. The implementing act shall be adopted in accordance with the examination procedure referred to in Article 93(2).

The Commission shall, on an ongoing basis, monitor developments in third countries and international organisations that could affect the functioning of decisions adopted pursuant to paragraph 3 of this Article and decisions adopted on the basis of Article 25(6) of Directive 95/46/EC.

The Commission shall, where available information reveals, in particular following the review referred to in paragraph 3 of this Article, that a third country, a territory or one or more specified sectors within a third country, or an international organisation no longer ensures an adequate level of protection within the meaning of paragraph 2 of this Article, to the extent necessary, repeal, amend or suspend the decision referred to in paragraph 3 of this Article by means of implementing acts without retro-active effect. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 93(2). On duly justified imperative grounds of urgency, the Commission shall adopt immediately applicable implementing acts in accordance with the procedure referred to in Article 93(3).

The Commission shall enter into consultations with the third country or international organisation with a view to remedying the situation giving rise to the decision made pursuant to paragraph 5.

A decision pursuant to paragraph 5 of this Article is without prejudice to transfers of personal data to the third country, a territory or one or more specified sectors within that third country, or the international organisation in question pursuant to Articles 46 to 49.

The Commission shall publish in the Official Journal of the European Union and on its website a list of the third countries, territories and specified sectors within a third country and international organisations for which it has decided that an adequate level of protection is or is no longer ensured.

Decisions adopted by the Commission on the basis of Article 25(6) of Directive 95/46/EC shall remain in force until amended, replaced or repealed by a Commission Decision adopted in accordance with paragraph 3 or 5 of this Article.

Source: EUR-Lex, Regulation (EU) 2016/679. Official text, reproduced without modification.

Related recitals

(103)

The Commission may decide with effect for the entire Union that a third country, a territory or specified sector within a third country, or an international organisation, offers an adequate level of d...

(104)

In line with the fundamental values on which the Union is founded, in particular the protection of human rights, the Commission should, in its assessment of the third country, or of a territory or spe...

(105)

Apart from the international commitments the third country or international organisation has entered into, the Commission should take account of obligations arising from the third country's or interna...

(106)

The Commission should monitor the functioning of decisions on the level of protection in a third country, a territory or specified sector within a third country, or an international organisation, and ...

(107)

The Commission may recognise that a third country, a territory or a specified sector within a third country, or an international organisation no longer ensures an adequate level of data protection. Co...

Cross-references

Art. 25: Data protection by design and by default Art. 93: Committee procedure

In addition to the overview at the bottom of this page: rulings, guidelines and fines that interpret or apply this article, newest first. Each item was checked against the official source.

Case law (2)

3 September 2025 · T-553/23 · General Court
Latombe v Commission
The General Court dismisses the action against the adequacy decision for the EU-US Data Privacy Framework, which therefore remains in force. An appeal against this judgment is pending before the Court of Justice (C-703/25 P).
6 October 2015 · C-362/14 · CJEUDirective 95/46
Schrems I
The Safe Harbour decision is invalid. An adequacy decision does not prevent a supervisory authority from examining a complaint about transfers to a third country.

Guidelines and decisions (5)

10 July 2023 · (EU) 2023/1795 · European Commission
EU-US Data Privacy Framework (adequacy decision)
Adequacy decision for transfers to US organisations certified under the Data Privacy Framework. The General Court dismissed an action against it in 2025 (Latombe); an appeal is pending.
10 November 2020 · EDPB
Recommendations 02/2020 on the European Essential Guarantees for surveillance measures
Describes four guarantees that public authority access in a third country must meet to justify interference with privacy and data protection.
6 February 2018 · WP254 rev.01 · Article 29 Working Party
Adequacy Referential
Sets out the substantive and procedural elements a third country's law must meet for an adequacy decision by the European Commission.
12 July 2016 · (EU) 2016/1250 · European Commission
EU-US Privacy Shield (adequacy decision, invalid)
Successor to Safe Harbour, with an Ombudsperson at the US State Department. The Court declared it invalid in 2020 in Schrems II.
26 July 2000 · 2000/520/EG · European Commission
Safe Harbour (adequacy decision, invalid)
Adequacy decision for US organisations that self-certified under the Safe Harbour principles. The Court declared it invalid in 2015 in Schrems I.

Line of case lawTransfers to the US: from Safe Harbour to the Data Privacy Framework

When may personal data go to the US and other third countries?

Safe Harbour (adequacy decision, invalid) (2000)First US adequacy arrangement, based on self-certification.
Schrems I (2015)The Court invalidates Safe Harbour; supervisory authorities must be able to examine transfer complaints.
EU-US Privacy Shield (adequacy decision, invalid) (2016)Successor with an Ombudsperson as an extra safeguard.
Schrems II (2020)Privacy Shield falls too; standard contractual clauses survive, but with an assessment per transfer.
Recommendations 01/2020 on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data (2021)The EDPB sets out how to carry out that assessment and which supplementary measures fit.
Standard contractual clauses for transfers to third countries (2021)New standard contractual clauses that build in the Schrems II assessment.
Meta: transfers of Facebook data to the US (2023)Largest GDPR fine to date, for transfers of Facebook data to the US.
EU-US Data Privacy Framework (adequacy decision) (2023)Third US adequacy decision, with a new redress mechanism.
Bindl v Commission (2025)First damages awarded for an unlawful transfer to the US, by an EU institution.
Latombe v Commission (2025)The General Court upholds the Data Privacy Framework; an appeal is pending.

Checked on 5 November 2026

Frequently asked questions

← Art. 44: General principle for transfers Art. 46: Transfers subject to appropriate safeguards →

Connections

Case law

Schrems II: Privacy Shield invalid, transfers under standard clauses only with essentially equivalent protection
2020-07-16 · final, Hof van Justitie van de EU (Grote kamer), Data Protection Commissioner tegen Facebook Ireland Ltd en Maximillian Schrems

Guidelines

Recommendations 01/2020 on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data
2021-06-18 · final, European Data Protection Board (EDPB)