Adequacy Assessment

Assessing Third-Country Adequacy

Overview

GDPR Article 45 provides that the European Commission may determine that a third country, a territory, or one or more specified sectors within a third country, or an international organisation ensures an adequate level of protection for personal data. Where such an adequacy decision exists, transfers of personal data to the covered country, territory, or sector may take place without any specific authorisation or additional safeguard requirement. This skill guides the assessment of existing adequacy decisions and the handling of partial adequacy coverage.

Current EC Adequacy Decisions

As of March 2026, the European Commission has adopted adequacy decisions for the following countries and territories:

Adequacy Assessment Criteria (Art. 45(2))

When the Commission assesses the adequacy of the level of protection in a third country, it considers:

(a) Rule of Law and Human Rights

• Respect for human rights and fundamental freedoms
• General and sectoral legislation, including public security, defence, national security, and criminal law
• Access by public authorities to personal data
• Effective and enforceable data subject rights

(b) Independent Supervisory Authority

• Existence and effective functioning of one or more independent supervisory authorities with responsibility for ensuring and enforcing data protection rules
• Adequate enforcement powers including the power to investigate, intervene, and impose corrective measures
• Independence from government interference

(c) International Commitments

• International commitments the third country has entered into, including multilateral and bilateral agreements relating to the protection of personal data
• Binding and enforceable obligations arising from such commitments

Partial Adequacy Handling

Several adequacy decisions cover only specific sectors or types of organisations within a country. Proper handling of partial adequacy is essential.

Canada — PIPEDA Partial Adequacy

Scope: Only transfers to Canadian organisations subject to the Personal Information Protection and Electronic Documents Act (PIPEDA) are covered by the adequacy decision. Provincial private-sector privacy laws that have been declared substantially similar to PIPEDA by the Governor in Council also fall within scope (e.g., Alberta PIPA, British Columbia PIPA, Quebec Act respecting the protection of personal information in the private sector).

Not covered:

• Canadian public sector organisations (federal and provincial government agencies)
• Organisations operating under provincial health information legislation
• Organisations not subject to PIPEDA or substantially similar legislation

Verification: Before relying on the Canada adequacy decision, confirm that the specific Canadian recipient is subject to PIPEDA or a substantially similar provincial law.

Japan — APPI Supplementary Rules

Scope: The adequacy decision covers commercial sector entities subject to Japan's Act on the Protection of Personal Information (APPI) and the supplementary rules adopted by the Personal Information Protection Commission (PPC) of Japan specifically for the purpose of the EU adequacy finding.

Supplementary rules:

1. Treatment of sensitive data: Japanese operators receiving data from the EU must treat all data received as "requiring special care" regardless of its category under APPI
2. Retention limitation: Data must be deleted when no longer necessary for the purpose of use
3. Onward transfers: Transfers outside Japan require either the data subject's consent or assurance that the recipient country provides equivalent protection
4. Anonymously processed information: Restrictions on the use of anonymised data equivalent to GDPR standards

Verification: Confirm the Japanese recipient is subject to APPI and has implemented the supplementary rules.