EU Adequacy Decisions: Full Country List and 2026 Updates

Under GDPR Article 45, the European Commission issues an adequacy decision when it determines that a non-EU country provides data protection essentially equivalent to EU standards. That designation lets personal data flow freely from the EU to that country without additional safeguards such as Standard Contractual Clauses.

An EU adequacy decision is a formal determination by the European Commission that a country outside the European Economic Area (EEA) provides a level of data protection "essentially equivalent" to that guaranteed within the EU. When a country receives an adequacy decision, personal data can flow freely from the EU to that country without organizations needing to implement additional safeguards such as Standard Contractual Clauses (SCCs) or Binding Corporate Rules.

The adequacy framework is established in Article 45 of the GDPR, which sets out the criteria the Commission must evaluate and the procedure for adoption, review, and revocation. Adequacy decisions are among the most consequential instruments in international data protection, since they determine whether seamless cross-border data flows are possible between the EU and its trading partners.

This guide covers how adequacy works, every country and organization that currently holds adequacy status, the 2024 review of the eleven pre-GDPR decisions, the UK's December 2025 renewal, Brazil's 2026 decision, the EU-US Data Privacy Framework and its litigation history, and what adequacy means for your organization.

Tracker status (verified October 26, 2026): the Commission's adequacy page lists no decision added, suspended or revoked since Brazil's in January 2026. The most recent Commission action it lists is the July 23, 2026 confirmation of South Korea's decision after its first periodic review. EUR-Lex shows no judgment, order or Advocate General opinion yet in the appeal against the General Court's ruling upholding the EU-US Data Privacy Framework (Case C-703/25 P).

How Adequacy Decisions Work Under GDPR Article 45

GDPR Article 45 empowers the European Commission to determine that a third country, a territory, one or more specified sectors within a third country, or an international organization ensures an adequate level of protection. The legal standard is not identical protection but "essential equivalence" with EU law.

The Assessment Criteria

When evaluating a country for adequacy, the Commission considers several factors outlined in Article 45(2):

Rule of law and human rights: The country's general legal framework, including legislation on national security, public interest, criminal law, and government access to personal data. The existence of an independent judiciary matters heavily.

Independent supervisory authority: Whether the country has one or more independent data protection authorities with adequate enforcement powers, including the ability to investigate, intervene, and sanction violations. The authority must also provide assistance and advice to data subjects exercising their rights.

International commitments: The country's participation in international data protection instruments, such as the Council of Europe Convention 108 and its modernized Protocol (Convention 108+), bilateral or multilateral agreements, and other legally binding obligations.

Data subject rights: Whether individuals have effective and enforceable rights, including access, rectification, erasure, and restriction of processing, and the right to effective administrative and judicial remedy.

Onward transfer rules: Whether the country imposes conditions on further transfers of data to other third countries, preventing adequacy from becoming a backdoor for data flows to jurisdictions with weaker protections.

The Adoption Process

The adequacy assessment is a lengthy process. The Commission conducts its evaluation, often over several years. The European Data Protection Board (EDPB) issues an opinion on the draft decision, as it did for Brazil in Opinion 28/2025. Member State representatives in a comitology committee vote to approve the decision. The European Parliament and Council may request the Commission to maintain, amend, or withdraw a decision.

From initial assessment to final adoption, the process typically takes two to four years. Countries that have ratified Convention 108+, established genuinely independent supervisory authorities with real enforcement power, and enacted comprehensive GDPR-aligned legislation tend to move through the process faster.

Monitoring and Periodic Review

Article 45(3) requires the Commission to monitor developments in adequate countries on an ongoing basis. Article 45(4) requires it to report periodically to the European Parliament and Council on the functioning of decisions. If the Commission finds that a country no longer provides essential equivalence, it may amend, suspend, or repeal the decision.

Countries with EU Adequacy Decisions

As of 2026, the European Commission has issued adequacy decisions for 17 countries, territories, and organizations. The list includes both pre-GDPR decisions (originally adopted under the 1995 Data Protection Directive and continuing in force under GDPR Article 45(9)) and decisions adopted since the GDPR took effect in May 2018.

Pre-GDPR Adequacy Decisions (Directive Era)

These decisions were adopted under Directive 95/46/EC before the GDPR took effect on May 25, 2018. They continue in force as long as they are not repealed or modified.

Andorra (adopted October 2010): Andorra's 2003 Qualified Law on Personal Data Protection and its independent supervisory authority (APDA) underpinned the adequacy finding. The Commission's January 2024 review confirmed adequacy continues to be warranted.

Argentina (adopted June 2003): Argentina's Personal Data Protection Act (Law 25,326) and the Agencia de Acceso a la Información Pública (AAIP) form the basis for adequacy. Argentina, Uruguay and, since 2026, Brazil are the South American countries with EU adequacy.

Canada (adopted December 2001, partial): Canada's adequacy is limited to organizations subject to the Personal Information Protection and Electronic Documents Act (PIPEDA) in their commercial activities. Public sector processing, organizations not subject to PIPEDA, and provincial legislation not recognized as substantially similar to PIPEDA fall outside the scope.

Faroe Islands (adopted March 2010): An autonomous territory within the Kingdom of Denmark with its own data protection legislation.

Guernsey (adopted November 2003): British Crown dependency whose Data Protection (Bailiwick of Guernsey) Law 2017, applied since 2019, aligns its regime closely with the GDPR.

Isle of Man (adopted April 2004): British Crown dependency with an independent data protection regime under the Information Commissioner's Office (Isle of Man).

Israel (adopted January 2011): Israel's Privacy Protection Act 1981 and the Privacy Protection Authority provided the framework. In its January 2024 review the Commission recommended that Israel codify in legislation protections developed below the level of statute, pointing to a Privacy Protection Bill (Amendment No. 14) then before the Knesset.

Jersey (adopted May 2008): British Crown dependency with its own data protection legislation (the Data Protection (Jersey) Law 2018) and supervisory authority (the Jersey Office of the Information Commissioner).

New Zealand (adopted December 2012): New Zealand's Privacy Act and the Office of the Privacy Commissioner provided the basis for adequacy. New Zealand has since replaced that law with the Privacy Act 2020.

Switzerland (adopted July 2000): One of the earliest adequacy decisions. Switzerland enacted a revised Federal Act on Data Protection (revFADP), effective September 1, 2023, which modernizes its framework to align more closely with GDPR. The Commission has been monitoring whether the revFADP strengthens Switzerland's adequacy position.

Uruguay (adopted August 2012): Uruguay's Data Protection Act (Law 18,331) and the Regulatory and Data Protection Unit (URCDP) supported the adequacy finding.

Post-GDPR Adequacy Decisions

Japan (adopted January 2019): The first adequacy decision adopted under the GDPR. Japan's Act on Protection of Personal Information (APPI) was supplemented by additional safeguards specifically negotiated with the EU, including stricter rules on sensitive data, onward transfers, and individual rights. The Commission completed its first review in April 2023, concluding adequacy remained warranted given continued alignment of the APPI with GDPR principles. In September 2025 the Commission and Japan's Personal Information Protection Commission announced that talks to extend the decision to academia and research had been concluded and that talks on extending it to the public sector would intensify; the Commission's adequacy page listed no amending decision as of October 2026.

Republic of Korea (South Korea) (adopted December 2021): South Korea's Personal Information Protection Act (PIPA), substantially amended in 2020, and the Personal Information Protection Commission (PIPC) supported the finding. Korea made additional commitments regarding government access to data for law enforcement and national security purposes. On July 23, 2026, the Commission concluded its first periodic review of the Korea decision and confirmed that Korea continues to provide an adequate level of protection.

United Kingdom (adopted June 2021, renewed December 2025): The UK adequacy decision is covered in detail in its own section below.

United States (DPF) (adopted July 2023): The adequacy decision applies only to US organizations certified under the EU-US Data Privacy Framework (DPF). There is no general adequacy finding for the United States. Transfers to non-certified US organizations still require SCCs or other safeguards.

Brazil (adopted January 26, 2026): The newest adequacy decision, adopted alongside Brazil's own adequacy decision on the EU. See detailed section below.

European Patent Organisation (adopted July 15, 2025): The first adequacy decision ever adopted for an international organization. This enables smooth data flows between EU entities and the EPO in support of the digital transformation of the patent-granting process.

The January 2024 Review of Eleven Pre-GDPR Decisions

On January 15, 2024, the European Commission published its Report on the first periodic review of the functioning of the eleven adequacy decisions adopted under Directive 95/46/EC (document SWD(2024) 3 final, accompanying Commission communication COM/2024/7). The eleven decisions reviewed were: Andorra, Argentina, Canada, the Faroe Islands, Guernsey, the Isle of Man, Israel, Jersey, New Zealand, Switzerland, and Uruguay.

Conclusion: All Eleven Continue to Provide Adequacy

The Commission's overall finding was that all eleven countries and territories continue to provide an adequate level of data protection and that none of the decisions need to be withdrawn or amended at this stage.

Country-Specific Observations

The review was not a blanket rubber-stamp. The Commission identified specific areas warranting continued monitoring:

For Argentina, the Commission recommended enshrining in legislation the protections developed at sub-legislative level, noting that the draft Data Protection Bill recently introduced in Congress could offer an opportunity to codify them.

For Israel, the Commission made a similar recommendation to codify protections developed at sub-legislative level and by case law, pointing to the Privacy Protection Bill (Amendment No. 14) then before the Knesset.

For Canada, the Commission recommended enshrining in legislation some protections developed at sub-legislative level and said the ongoing legislative reform of PIPEDA, then Bill C-27, could offer an opportunity to codify them.

For New Zealand, the Commission welcomed the comprehensive reform brought by the Privacy Act 2020 and a pending bill to strengthen its transparency requirements.

The Commission confirmed that the adequacy decisions for Guernsey, Isle of Man, Jersey, the Faroe Islands, Andorra, Switzerland, and Uruguay continue to operate satisfactorily, while recommending maintenance of close monitoring of regulatory developments in each jurisdiction.

The UK Adequacy Decision: Sunset Clause, Extension, and December 2025 Renewal

The UK adequacy decision has a more complex history than any other adequacy decision, because of the unique sunset clause inserted at the time of the original adoption.

The 2021 Original Decision and Sunset Clause

The Commission adopted the UK adequacy decision on June 28, 2021, just before the bridging arrangement in the EU-UK Trade and Cooperation Agreement expired. Unlike every other adequacy decision, the UK decision contained a four-year sunset clause causing it to expire automatically on June 27, 2025, unless renewed. The clause was inserted because the Commission wanted the ability to reassess the UK's data protection framework as it evolved independently from EU law following Brexit.

The June 2025 Technical Extension

As the June 27, 2025 expiry date approached, the Commission had not yet completed its formal renewal process. On June 24, 2025, the Commission adopted a six-month technical extension of both the GDPR-based and LED-based UK adequacy decisions (for the GDPR decision, Implementing Decision (EU) 2025/1226), moving their expiry to December 27, 2025 and preserving data flows while the renewal assessment was finalized.

The December 19, 2025 Renewal

On December 19, 2025, the Commission formally renewed the UK adequacy decisions under both the GDPR and the Law Enforcement Directive (LED), through Implementing Decisions (EU) 2025/2574 and 2025/2571. The renewed decisions run for six years, expiring on December 27, 2031. The Commission committed to a midpoint review after four years, working closely with the EDPB.

The Commission concluded that the UK continues to provide essentially equivalent data protection despite a number of legislative changes since 2021. Key among these was the UK's enactment of the Data (Use and Access) Act 2025 (DUAA), which received Royal Assent on June 19, 2025. The DUAA replaced the proposed Data Protection and Digital Information Bill, which had contained more significant divergences from GDPR standards. The Commission assessed the DUAA and found that the UK's overall framework remained essentially equivalent.

EDPB Opinion and Monitoring Conditions

The EDPB adopted its opinion on the draft UK adequacy decisions in October 2025. While welcoming the renewal, the EDPB called on the Commission to ensure effective monitoring of several areas, including the UK's immigration exemption from data protection rules, the UK-US Data Bridge and its implications for onward transfers of EU data to the US, and the risk of future divergence as the UK's framework continues to develop independently.

The renewal means that for the six-year period to December 2031, organizations can transfer personal data freely between the EU and the UK under the adequacy decisions. Organizations relying on UK adequacy should maintain awareness of the monitoring conditions and keep contingency plans for SCCs should the Commission decide not to renew again in 2031.

Brazil: The Newest Adequacy Decision (January 2026)

On January 26, 2026, the European Commission adopted Implementing Decision (EU) 2026/179, recognizing Brazil's LGPD framework as providing adequate data protection under GDPR Article 45. On the same date, Brazil's national data protection authority (ANPD) adopted Resolution CD/ANPD No. 32, mutually recognizing the EU as providing adequate protection under the Brazilian General Data Protection Law (LGPD).

What Makes the Brazil Decision Distinctive

The Brazil decision has several notable features:

Mutual recognition: Both sides recognized each other's adequacy on the same day. Brazil's ANPD Resolution 32 mirrors the EU decision, allowing free data flows in both directions. The EU's arrangements with Japan (2019) and the Republic of Korea, whose decision on the EU entered into force in September 2025, are also reciprocal.

Public and private sectors: Unlike Canada (commercial activities only) and the US (DPF-certified organizations only), the decision covers transfers to controllers and processors in Brazil subject to the LGPD, which the Commission says allows businesses, public authorities and researchers to exchange data freely.

Security carve-out: The LGPD exempts processing carried out exclusively for public safety, national defence, State security or the investigation and prosecution of criminal offences, but the decision notes that this exemption is only partial, because Brazil's Federal Supreme Court has held that the LGPD's main principles, rights and objectives apply to all processing by public authorities.

Review schedule: The Commission must evaluate the finding four years after the decision was notified to the Member States and at least every four years after that, and it monitors the framework continuously in the meantime.

Background: Brazil's Data Protection Framework

Brazil enacted its Lei Geral de Proteção de Dados (LGPD) in 2018, effective from September 2020. The LGPD closely mirrors the structure and principles of the GDPR, covering lawful basis for processing, data subject rights, data breach notification, and requirements for data protection officers. The ANPD was established as an independent supervisory authority and issued implementing regulations on international data transfer mechanisms and security incident notification that further aligned Brazil's framework with EU standards.

The EDPB adopted its opinion on the Commission's draft decision (Opinion 28/2025) on November 4, 2025, and the final decision was adopted January 26, 2026.

The EU-US Data Privacy Framework

The EU-US Data Privacy Framework (DPF) was adopted as an adequacy decision on July 10, 2023, following intensive negotiations between the Commission and the Biden administration. The DPF replaced the Privacy Shield framework that the Court of Justice of the EU (CJEU) had invalidated in Schrems II in July 2020.

How the DPF Works

Unlike country-wide adequacy decisions, the DPF is a self-certification scheme. US organizations voluntarily certify compliance with the DPF Principles through the International Trade Administration (ITA) at dataprivacyframework.gov. Certified organizations agree to the DPF Principles and to submit to FTC and Department of Transportation enforcement. EU individuals may seek redress through a Data Protection Review Court (DPRC) established by Executive Order 14086 for claims regarding US signals intelligence activities.

The October 2024 First Annual Review

On October 9, 2024, the Commission published its Report on the first periodic review of the EU-US DPF (COM(2024) 451 final). The review meeting took place in Washington, D.C. on July 18 to 19, 2024.

Key findings: the Commission found that the DPF was functioning as intended in its first year, with strong SME participation (according to the Department of Commerce, 70% of participants are SMEs) and significant representation from the ICT sector (47% of DPF companies). The US authorities confirmed there had been no changes to Executive Order 14086 since its adoption; the Commission noted that the Reforming Intelligence and Securing America Act (RISAA) of April 19, 2024 had made three main changes to the scope of surveillance under Section 702 FISA, along with institutional and procedural changes, and said it would monitor further developments.

Litigation: The Latombe Case (September 2025)

The DPF faced its first judicial challenge in Case T-553/23, Philippe Latombe v. European Commission, before the European General Court. On September 3, 2025, the General Court dismissed the action, confirming that the United States ensures an adequate level of protection for personal data transferred under the DPF. The Court found that US signals intelligence activities are subject to judicial supervision by the DPRC, whose decisions are final and binding, satisfying the essential equivalence standard established in Schrems II.

Latombe appealed to the Court of Justice on October 31, 2025 (Case C-703/25 P); as of October 2026 EUR-Lex shows no judgment, order or Advocate General opinion in the appeal. NOYB (None of Your Business), the privacy advocacy group founded by Max Schrems, has indicated it is monitoring developments and may bring a separate broader challenge.

Ongoing Political Uncertainty

The DPF's longer-term stability faces political and legal risks stemming from the Trump administration's actions since 2025. Key concerns include:

PCLOB: In January 2025, the Trump administration dismissed the Democratic members of the Privacy and Civil Liberties Oversight Board, leaving the Board without a quorum. The PCLOB plays a role in overseeing the US surveillance framework that underpins the DPF's safeguards.

FTC independence: An executive order on agency accountability in February 2025 raised concerns about whether the FTC retains sufficient independence to enforce DPF commitments against certified organizations. On June 29, 2026 the US Supreme Court held in Trump v. Slaughter that the FTC's for-cause removal provision, 15 U.S.C. 41, is contrary to the separation of powers enshrined in the Constitution. The FTC is one of the US agencies that enforce the DPF Principles against certified organizations.

Organizations relying on the DPF should maintain updated SCC arrangements as a backup.

How Adequacy Decisions Are Revoked or Challenged

The history of EU-US data transfer frameworks illustrates the fragility of adequacy-based arrangements and the consequences of revocation.

Schrems I: Safe Harbor (2015)

In October 2015, the CJEU invalidated the Safe Harbor framework (Case C-362/14, Schrems v. Data Protection Commissioner) following revelations about US mass surveillance programs disclosed by Edward Snowden. The Court found that the Commission's Safe Harbor adequacy decision failed to provide essentially equivalent protection, because US law permitted mass access to personal data without adequate judicial oversight.

Schrems II: Privacy Shield (2020)

In July 2020, the CJEU invalidated the Privacy Shield framework (Case C-311/18, Data Protection Commissioner v. Facebook Ireland) on the same essential grounds: US surveillance law did not provide data subjects with enforceable rights or an effective judicial remedy equivalent to EU standards. The Court also confirmed that Standard Contractual Clauses remain valid but that data exporters must conduct Transfer Impact Assessments before relying on them.

Practical Consequences of Revocation

When an adequacy decision is invalidated, the legal basis for transfers disappears immediately. After Schrems II:

• US companies that had relied on Privacy Shield as their sole transfer mechanism had to implement alternative safeguards on short notice.
• EU organizations discovered they needed to renegotiate contracts with hundreds of service providers.
• Data protection authorities began enforcement actions against transfers to the US that lacked a valid legal basis.

There is no guaranteed transition period when adequacy is revoked. Organizations should treat adequacy as one layer of their transfer strategy rather than the only layer, and maintain current SCC arrangements wherever adequacy decisions affect critical data flows.

Partial and Sector-Specific Adequacy

The GDPR explicitly allows adequacy for "one or more specified sectors" within a country. Two current decisions illustrate how partial adequacy works in practice.

Canada: Commercial Activities Only

Canada's adequacy applies only to organizations subject to PIPEDA in their commercial activities. Processing by government agencies, data processed under provincial legislation not recognized as substantially similar to PIPEDA, and non-commercial processing fall outside the scope of the decision.

Canada's data protection reform efforts have been ongoing for several years. Bill C-27, which would have enacted the Consumer Privacy Protection Act as a successor to PIPEDA, was not enacted: the parliamentary session ended on January 6, 2025 with the bill still at committee stage, and PIPEDA remains in force.

United States: DPF-Certified Organizations Only

The US adequacy decision is the most limited in scope. It covers only organizations that have actively self-certified under the DPF through the ITA. There is no general adequacy finding for the United States as a country. Transfers to non-certified US organizations must rely on SCCs, Binding Corporate Rules, or another mechanism under GDPR Article 46.

Pending Adequacy Assessments

With Brazil's addition in 2026, the queue of near-term candidates for adequacy has narrowed, but several countries remain in various stages of discussion or assessment.

Taiwan: Taiwan's Personal Data Protection Act and its planned amendments have drawn EU interest, particularly in the context of strengthening EU-Taiwan economic and technology ties. An adequacy finding for Taiwan would be politically sensitive given cross-strait dynamics, but its strong legislative foundation makes it a credible candidate.

Kenya: Kenya enacted a comprehensive Data Protection Act in 2019, established a Data Commissioner, and has worked to align its framework with international standards. Sub-Saharan African adequacy remains a longer-term possibility.

India: India enacted the Digital Personal Data Protection Act 2023 (DPDPA), establishing a new supervisory framework (Data Protection Board). India-EU discussions on adequacy are nascent, with government access and national security exemptions representing significant hurdles.

Countries that have ratified Convention 108+, established genuinely independent supervisory authorities with adequate enforcement budgets and track records, and enacted comprehensive legislation with GDPR-comparable principles are best positioned. The scope of national security exemptions has historically been the hardest factor for countries with large intelligence agencies to satisfy.

What Adequacy Means for Businesses

The Benefits

For organizations transferring personal data to adequate countries, the practical benefit is significant simplification. No SCCs, no Transfer Impact Assessments, no Binding Corporate Rules. The exporter need only confirm that the destination is listed as adequate at the time of transfer.

This reduces legal costs, speeds up vendor onboarding, eliminates the need to renegotiate data processing agreements when adding vendors in adequate jurisdictions, and removes the compliance overhead of maintaining SCC libraries.

The Limitations

Adequacy does not override other GDPR requirements. The exporting organization must still have a lawful basis for the processing, comply with data minimization and purpose limitation principles, and respect data subject rights. Adequacy only removes the requirement for an additional transfer safeguard under Article 46.

The receiving organization in the adequate country must also comply with that country's own data protection law. Adequacy decisions do not convert EU GDPR obligations into the law of the destination country.

Managing Reliance Risk

Given that two US adequacy frameworks have been invalidated and the UK decision required renewal with monitoring conditions attached, adequacy decisions should be treated as useful but not unconditional. Organizations should:

• Maintain parallel SCC arrangements for any data flows to countries where adequacy stability is uncertain, particularly the US under the DPF.
• Track the Commission's periodic reviews and EDPB opinions for signs of adequacy being put under pressure.
• Monitor legislative developments in adequate countries that could push their frameworks below the essential equivalence threshold.

This is general legal information, not legal advice. Organizations relying on adequacy decisions for international data transfers should consult an attorney for advice specific to their situation.

Frequently Asked Questions

What is an EU adequacy decision?

An EU adequacy decision is a formal determination by the European Commission under GDPR Article 45 that a non-EU country provides data protection essentially equivalent to EU standards. When a country has adequacy status, personal data can flow freely from the EU to that country without organizations needing additional safeguards like Standard Contractual Clauses or Binding Corporate Rules. The standard is essential equivalence, not identical protection.

Which countries have EU adequacy decisions in 2026?

As of 2026, 17 countries, territories, and organizations have adequacy: Andorra, Argentina, Brazil (January 2026), Canada (commercial sector only), the Faroe Islands, Guernsey, the Isle of Man, Israel, Japan, Jersey, New Zealand, the Republic of Korea, Switzerland, the United Kingdom (renewed December 2025 to December 2031), the United States (only for DPF-certified organizations), Uruguay, and the European Patent Organisation (July 2025). Several of these were adopted under the 1995 Directive and continue in force under GDPR Article 45(9).

Was the UK adequacy decision renewed?

Yes. The original UK adequacy decision carried a four-year sunset clause expiring June 27, 2025. On June 24, 2025 the Commission adopted a technical extension to preserve data flows while the renewal assessment was completed. On December 19, 2025 the Commission formally renewed both the GDPR-based and LED-based UK adequacy decisions for a further six years to December 27, 2031, following its assessment of the UK's Data (Use and Access) Act 2025.

What was the January 2024 review of adequacy decisions?

On January 15, 2024 the Commission published its Report on the first periodic review of the eleven adequacy decisions adopted under the 1995 Data Protection Directive (covering Andorra, Argentina, Canada, the Faroe Islands, Guernsey, Isle of Man, Israel, Jersey, New Zealand, Switzerland, and Uruguay). The Commission concluded that all eleven continue to provide adequate protection. The report included country-specific observations, notably recommending that Argentina and Israel codify in legislation protections developed at sub-legislative level, and noting the then-pending reform of Canada's PIPEDA.

What is the Brazil EU adequacy decision?

On January 26, 2026, the European Commission adopted Implementing Decision (EU) 2026/179, recognizing Brazil's LGPD framework as providing adequate data protection. Brazil simultaneously adopted ANPD Resolution 32, mutually recognizing EU adequacy under the LGPD. It covers controllers and processors in Brazil subject to the LGPD, in both the public and private sectors, and is reciprocal, as the EU's arrangements with Japan and Korea already were. The LGPD's exemption for public safety, national defence, State security and criminal investigations carries over, though the decision notes that the exemption is only partial.

What is the EU-US Data Privacy Framework and is it still valid?

The EU-US Data Privacy Framework (DPF), adopted July 2023, is an adequacy decision covering only US organizations that self-certify through the International Trade Administration. It survived its first judicial challenge when the European General Court dismissed Case T-553/23 in September 2025. However, the Trump administration's dismissal of PCLOB members and questions about FTC independence, sharpened by the US Supreme Court's June 2026 ruling in Trump v. Slaughter that the FTC's for-cause removal protection is unconstitutional, have created uncertainty about the DPF's long-term stability. As of October 2026 EUR-Lex showed no judgment or order in Latombe's appeal to the Court of Justice (C-703/25 P). Organizations relying on the DPF may want to keep SCC arrangements as a fallback.

What happens if an adequacy decision is revoked?

When an adequacy decision is invalidated or revoked, the legal basis for data transfers disappears immediately. There is no guaranteed transition period. Organizations must implement alternative transfer mechanisms, primarily Standard Contractual Clauses, or halt transfers. The Schrems II invalidation of Privacy Shield in 2020 left the US companies that had relied on it as their sole transfer mechanism needing alternative safeguards.

What is the difference between adequacy and Standard Contractual Clauses?

Adequacy decisions allow data transfers without any additional formalities, because the Commission has already assessed the destination country's legal framework. Standard Contractual Clauses (SCCs) are contractual safeguards that organizations must themselves put in place, along with Transfer Impact Assessments, when transferring data to countries without adequacy. Adequacy is simpler in practice but less stable; SCCs give more control but require more compliance infrastructure. Learn more in our guide to Standard Contractual Clauses.

Which countries might get EU adequacy decisions next?

Taiwan, India, and Kenya are discussed as potential future candidates. India's 2023 Digital Personal Data Protection Act established a new legal basis for candidacy, but government access provisions remain a hurdle. Taiwan's strong legislative alignment and economic ties to the EU make it a credible longer-term candidate. Countries that have ratified Convention 108+, established independent supervisory authorities, and enacted comprehensive GDPR-aligned legislation are best positioned.