An adequacy decision is a decision adopted by the European Commission on the basis of Article 45 of the GDPR, which establishes that a third country (i.e. a country not bound by the GDPR) or international organisation ensures an adequate level of protection of personal data. Such a decision takes into account the country’s domestic laws, its supervisory authorities, and international commitments it has entered into.

The effect of such a decision is that personal data can flow from the EU Member States and European Economic Area member countries to that third country, without any further requirements. The European Commission publishes a list of its adequacy decisions on its website.