Adequacy decision
In shortWhile it stands, data may flow to the US. It can fall at any time.
An adequacy decision is a decision of the European Commission. It finds that a country outside the EU protects personal data in a comparable way. Where one exists, transferring data there is as simple as transferring it to Portugal: no standard contractual clauses, no case-by-case assessment.
Such decisions exist for Switzerland, the United Kingdom, Japan, Canada, South Korea, New Zealand and Israel, among others. Since July 2023, once again for the United States, in the form of the EU–US Data Privacy Framework.
Why the US decision is treated differently
It is the third attempt. Safe Harbor fell in 2015, the Privacy Shield in 2020. On both occasions the Court of Justice held that American surveillance powers reach too far and that the people affected have no effective remedy. See Schrems II.
The current decision does not rest on a new statute but on a presidential executive order and a newly created review court. A subsequent administration can change both without going to Congress.
What to do with it
Use it. It is valid law, and insisting on standard contractual clauses where a decision applies creates work without benefit.
But do not build on the assumption that it will still exist in five years. The practical handling is unglamorous: know which processing operations would fall if it went, and know a replacement route for the most important of them. That is not panic; it is the same exercise you run for every other single point of failure in a supply chain. See Exit strategy.
The most common confusion
An adequacy decision governs data protection. It does not govern availability. A US provider may process your data entirely lawfully and still cut off your access tomorrow because a sanctions list, an export control or a corporate decision got in the way. That is a different risk category, and no data protection decision in the world covers it.