Adequate Level of Protection

Under GDPR Article 45, the European Commission can issue an adequacy decision recognising that a third country, territory or sector offers an 'adequate level of protection' for personal data. Where such a decision is in force, transfers to the destination do not need additional Article 46 safeguards (such as Standard Contractual Clauses or Binding Corporate Rules). Current adequacy decisions include the UK, Switzerland, Japan, South Korea, Canada (commercial organisations), Argentina, Uruguay and, under the EU-US Data Privacy Framework, certified US organisations.

Other laws use different machinery to the same end. The UK ICO maintains its own adequacy register under the UK GDPR. India's DPDP Act Rule 15 operates in reverse — all countries are permitted unless the Central Government notifies them as restricted. The UAE PDPL defers to adequacy determinations by the UAE Data Office. Adequacy is a political as well as a legal instrument, and decisions are periodically reviewed; the Schrems II judgment invalidated the previous EU-US Privacy Shield, which is why adequacy under the current DPF is designed to survive similar legal challenge.