Adequacy Decision

Many privacy laws restrict sending personal data abroad. One way to meet that rule is for the exporting jurisdiction to declare the destination adequate. Under the EU's GDPR, the European Commission makes this finding after studying the other country's laws, enforcement, oversight body and rules on government access. Once granted, organisations need no extra transfer tools, such as contract clauses, for data going there. Decisions are reviewed from time to time and can be withdrawn, and some cover only one sector or scheme. Other legal systems use similar ideas under other names. Privacy teams check the list of adequate countries before building a cross-border data flow. Where no decision exists, the exporter has to fall back on contract clauses or another transfer tool.

A European online retailer wants to store customer records with a cloud provider in a non-EU country. Its privacy team first checks whether the EU has recognised that country as adequate. It has, so the transfer goes ahead without further contracts. A second country on the vendor's list has no such finding, so the retailer uses a different transfer mechanism there.