What happens when an adequacy decision falls?

The legal basis disappears immediately. Affected transfers must switch to standard contractual clauses with your own assessment, or stop. In Schrems II that happened in 2020 with no transition period, catching thousands of companies unprepared.

Does a decision cover every provider in that country?

Not necessarily. For the United States it covers only recipients certified under the Data Privacy Framework and listed publicly. For countries with a general decision — Switzerland, for instance — it applies across the board.

Do I still need a transfer impact assessment?

Not while a valid adequacy decision applies. It is still worth knowing, for your most important processing activities, what a lapse would mean — that is planning rather than obligation.

How do I check whether a US provider is certified?

Through the public Data Privacy Framework list maintained by the US Department of Commerce. Certification must be renewed annually; a lapsed entry means the basis for that recipient is gone.

Back to the wiki

Law · 2 min read · Updated 16 August 2026

Adequacy decision

In shortAn adequacy decision permits transfers to a third country without extra safeguards — until it is struck down.

At a glance

Legal basis: Article 45 GDPR; the Commission decides, and Parliament and Council can have the decision reviewed
Effect: Transfers as if inside the EU — no standard clauses, no supplementary measures
Countries covered: Switzerland, the United Kingdom, Japan, South Korea, Canada (commercial sector), New Zealand, Israel, Uruguay and Argentina, among others
United States: Since July 2023 through the EU–US Data Privacy Framework, limited to certified recipients
Review: Periodic evaluation by the Commission; annulment possible at any time, with no guaranteed transition period
Historical record: Two of three US arrangements were annulled by the CJEU (2015 and 2020)

An adequacy decision is the European Commission's finding that a third country offers a level of data protection essentially equivalent to the European one. Where one exists, personal data may be transferred there as if within the Union — no standard contractual clauses, no supplementary measures, no assessment of your own.

It is the most convenient legal basis available. And the least stable.

What the Commission examines

The assessment covers the rule of law in the destination country, the existence and independence of a supervisory authority, enforceable rights for individuals and — the decisive point — the powers of security agencies together with the redress available against them.

That last point is where both US predecessor arrangements failed. Not on the data protection duties of companies, but on state access and the absence of a legal route for non-US persons; the detail sits under FISA 702.

The list, briefly

Decisions exist for Switzerland, the United Kingdom, Japan, South Korea, Canada in the commercial sector, New Zealand, Israel, Uruguay and Argentina, among others.

For the United States the EU–US Data Privacy Framework has applied since July 2023. It does not work across the board but only for recipients that have certified and appear on the public list. That is a material difference from Switzerland, where the decision covers every recipient.

Why planning is still necessary

The history of these decisions is short and unambiguous. Safe Harbor fell in 2015, the Privacy Shield in 2020, both through judgments of the Court of Justice, both without a transition period. The third framework rests in essential parts on a US executive order a future administration can change, and it is already under challenge.

That calls for no panic, only a plain planning rule: for the three to five processing activities that weigh most, it should be known what a lapse would mean — technically, contractually and in working hours. It is the same thought behind every Exit strategy, applied to a legal basis rather than to a provider.

What a lapse actually triggers

The transfer needs a different basis immediately. Usually that means standard contractual clauses combined with the duty to assess from Schrems II — precisely the work the adequacy decision had spared you.

Where that assessment shows the level of protection does not hold and supplementary measures do not bridge the gap, the only remaining option is to move the processing. Preparing soberly for that is therefore not ideology but risk provision: it costs a day a year and replaces a quarter of improvisation when it matters.

Common questions

What happens when an adequacy decision falls?: The legal basis disappears immediately. Affected transfers must switch to standard contractual clauses with your own assessment, or stop. In Schrems II that happened in 2020 with no transition period, catching thousands of companies unprepared.
Does a decision cover every provider in that country?: Not necessarily. For the United States it covers only recipients certified under the Data Privacy Framework and listed publicly. For countries with a general decision — Switzerland, for instance — it applies across the board.
Do I still need a transfer impact assessment?: Not while a valid adequacy decision applies. It is still worth knowing, for your most important processing activities, what a lapse would mean — that is planning rather than obligation.
How do I check whether a US provider is certified?: Through the public Data Privacy Framework list maintained by the US Department of Commerce. Certification must be renewed annually; a lapsed entry means the basis for that recipient is gone.