Adequacy decision
Definition
An adequacy decision is a formal finding by an authority that another country ensures an adequate level of data protection, allowing transfers there without further safeguards.
Under GDPR Art. 45, the European Commission may decide that a third country, a territory, a specified sector or an international organisation ensures a level of protection essentially equivalent to that in the EU. The assessment covers the rule of law, access by public authorities, the existence of an independent supervisory authority and international commitments. Decisions are reviewed periodically and can be suspended or annulled, as happened twice with EU-US arrangements before the current framework.
The LGPD (Arts. 33, I and 34) gives the ANPD the power to assess the level of protection of foreign countries and international organisations, using criteria such as the destination's general and sectoral legislation, security measures and the existence of guarantees for data subjects.
Adequacy simplifies transfers but does not exempt exporters from the rest of the law: they still need a lawful basis, transparency and a processing agreement where a processor is involved. Example: a company sending HR data to an affiliate in a country covered by an adequacy decision records that mechanism instead of signing standard contractual clauses.
Where this term is assessed
Assessed in the Data Protection & AI Professional (DPAI), domain 5: International transfers and vendors.
Primary sources
- GDPR Art. 45
- LGPD Art. 33, I and Art. 34