Article 45: Transfers on the basis of an adequacy decision - GDPR

1. A transfer of personal data to a third country or an international organisation may take place where the Commission has decided that the third country, a territory or one or more specified sectors within that third country, or the international organisation in question ensures an adequate level of protection. Such a transfer shall not require any specific authorisation.

2. When assessing the adequacy of the level of protection, the Commission shall, in particular, take account of the following elements:

(a) the rule of law, respect for human rights and fundamental freedoms, relevant legislation, both general and sectoral, including concerning public security, defence, national security and criminal law and the access of public authorities to personal data, as well as the implementation of such legislation, data protection rules, professional rules and security measures, including rules for the onward transfer of personal data to another third country or international organisation which are complied with in that country or international organisation, case-law, as well as effective and enforceable data subject rights and effective administrative and judicial redress for the data subjects whose personal data are being transferred;
(b) the existence and effective functioning of one or more independent supervisory authorities in the third country or to which an international organisation is subject, with responsibility for ensuring and enforcing compliance with the data protection rules, including adequate enforcement powers, for assisting and advising the data subjects in exercising their rights and for cooperation with the supervisory authorities of the Member States; and
(c) the international commitments the third country or international organisation concerned has entered into, or other obligations arising from legally binding conventions or instruments, as well as from its participation in multilateral or regional systems, in particular in relation to the protection of personal data.

3. The Commission, after assessing the adequacy of the level of protection, may decide, by means of implementing act, that a third country, a territory or one or more specified sectors within a third country, or an international organisation ensures an adequate level of protection within the meaning of paragraph 2 of this Article. The implementing act shall provide for a mechanism for a periodic review, at least every four years, which shall take into account all relevant developments in the third country or international organisation. The implementing act shall specify its territorial and sectoral application and, where applicable, identify the supervisory authority or authorities referred to in point (b) of paragraph 2 of this Article. The implementing act shall be adopted in accordance with the examination procedure referred to in Article 93(2).

4. The Commission shall, on an ongoing basis, monitor developments in third countries and international organisations that could affect the functioning of decisions adopted pursuant to paragraph 3 of this Article and decisions adopted on the basis of Article 25(6) of Directive 95/46/EC.

5. The Commission shall, where available information reveals, in particular following the review referred to in paragraph 3 of this Article, that a third country, a territory or one or more specified sectors within a third country, or an international organisation no longer ensures an adequate level of protection within the meaning of paragraph 2 of this Article, to the extent necessary, repeal, amend or suspend the decision referred to in paragraph 3 of this Article by means of implementing acts without retro-active effect. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 93(2). On duly justified imperative grounds of urgency, the Commission shall adopt immediately applicable implementing acts in accordance with the procedure referred to in Article 93(3).

6. The Commission shall enter into consultations with the third country or international organisation with a view to remedying the situation giving rise to the decision made pursuant to paragraph 5.

7. A decision pursuant to paragraph 5 of this Article is without prejudice to transfers of personal data to the third country, a territory or one or more specified sectors within that third country, or the international organisation in question pursuant to Articles 46 to 49.

8. The Commission shall publish in the Official Journal of the European Union and on its website a list of the third countries, territories and specified sectors within a third country and international organisations for which it has decided that an adequate level of protection is or is no longer ensured.

9. Decisions adopted by the Commission on the basis of Article 25(6) of Directive 95/46/EC shall remain in force until amended, replaced or repealed by a Commission Decision adopted in accordance with paragraph 3 or 5 of this Article.

Understanding This Article

Article 45 establishes the "adequacy decision" mechanism—the gold standard for international data transfers. When the European Commission formally recognizes that a third country, territory, or sector provides an adequate level of data protection, transfers can flow freely without additional safeguards or authorizations. This is the simplest and most efficient transfer mechanism under GDPR.

The adequacy assessment is comprehensive and goes far beyond just data protection laws. The Commission examines the rule of law, respect for human rights, legislation on public security and law enforcement access to data, effective supervisory authorities with real enforcement powers, effective judicial redress for data subjects, and international commitments. This holistic approach recognizes that data protection cannot exist in isolation—it requires a broader ecosystem of legal protections and institutional safeguards.

Adequacy decisions are not permanent. They must be reviewed at least every four years, and the Commission continuously monitors developments. If a country's protection level deteriorates—due to new surveillance laws, weakening of supervisory authorities, or other changes—the Commission can suspend or repeal the adequacy decision. This happened with the US twice: first with the Safe Harbor framework (invalidated by Schrems I in 2015), then with Privacy Shield (invalidated by Schrems II in 2020).

Importantly, adequacy can be granted at different levels: entire countries (like Canada or Japan), specific territories (like Guernsey), or particular sectors (like the commercial sector in adequacy decisions). This flexibility allows recognition where appropriate protections exist even if the entire country doesn't meet standards.

Key Points

Commission can recognize third countries as providing adequate data protection

Adequacy assessment considers rule of law, data protection rules, supervisory authorities, and international commitments

Adequacy decisions must be reviewed at least every four years

Commission continuously monitors developments that could affect adequacy

Adequacy can be granted for entire countries, territories, or specific sectors

Decisions can be repealed, amended, or suspended if protection level deteriorates

Transfers based on adequacy decisions require no specific authorization

Practical Application

Example 1 - Simple Transfer to Adequate Country: A Spanish e-commerce company wants to use a Swiss data center to host customer data. Switzerland has an adequacy decision from the European Commission. The Spanish company can transfer personal data to Switzerland without any additional authorization, contract clauses, or impact assessments. They simply need to ensure their Swiss provider processes data lawfully according to their agreement and GDPR requirements.

Example 2 - UK Post-Brexit: After Brexit, the UK was granted adequacy decisions in June 2021 (separate decisions for GDPR and law enforcement). EU companies can continue transferring data to the UK freely, as if it were still in the EU. However, the adequacy decision includes "sunset clauses" and must be reviewed—if UK data protection standards diverge significantly from EU standards, the adequacy decision could be suspended, requiring companies to quickly implement alternative transfer mechanisms.

Example 3 - Monitoring for Changes: A German company transfers customer data to a Japanese subsidiary, relying on Japan's adequacy decision. The company monitors news and legal developments in Japan for changes that could affect data protection. When Japan considers new national security legislation that could expand government access to private data, the company assesses whether this could affect the adequacy decision and prepares contingency plans (like Standard Contractual Clauses) in case the Commission suspends Japan's adequacy status.

Example 4 - Sectoral Adequacy: A French financial services company wants to transfer data to Argentina. Argentina has an adequacy decision, but it primarily covers the commercial sector. The French company verifies that their specific data processing activities fall within the scope of Argentina's adequacy decision. For any processing that might fall outside (such as transfers to Argentine government agencies), they would need alternative transfer mechanisms under Articles 46-49.

Example 5 - Adequacy Suspended: When the Court of Justice invalidated the Privacy Shield in Schrems II (July 2020), companies transferring data to the US suddenly lost their primary legal basis. Companies had to quickly implement alternative mechanisms—primarily Standard Contractual Clauses with supplementary measures like encryption, data minimization, and careful vendor selection based on whether vendors could be subject to US surveillance laws. This showed the importance of not relying solely on adequacy decisions without backup plans.

Understanding This Article

Key Points

Practical Application

Related Recitals

Related Articles in Chapter 5

Popular Articles