When does an Article 45 adequacy decision let a transfer proceed without extra paperwork?
An adequacy decision lets a transfer proceed without further authorization only when the Commission has decided that the destination ensures an adequate level of protection. Under Article 45(1), a transfer to a third country, a territory or a specified sector within it, or an international organization can take place without specific authorization once that decision exists. The Commission's list as of October 2026 covers Andorra, Argentina, Brazil, Canada (commercial organizations), the Faroe Islands, Guernsey, Israel, the Isle of Man, Japan, Jersey, New Zealand, the Republic of Korea, Switzerland, the United Kingdom, the United States (DPF participants), Uruguay and the European Patent Organisation. Check the Commission's adequacy decisions page for the current list before you rely on any entry, because the list changes.
The legal test is rarely the hard part. The harder question is whether the decision matches your data flow. Many decisions cover a sector or a condition, such as a US recipient that has self-certified to the Data Privacy Framework, or Canada limited to commercial organizations. Confirm that the importer is inside that scope, that the data categories and purposes fit what the decision describes, and that any onward transfer from the importer is also covered. If the recipient falls outside the scope, the transfer has no adequacy basis and you must move to an Article 46 tool or stop the flow. Record this scope check in your transfer register, naming the decision and the recipient entity it relies on.
Adequacy is not a permanent finding. Implementing acts must provide for periodic review at least every four years, and the Commission may repeal, amend or suspend a decision without retroactive effect. Assign an owner to watch the Commission's list and its review announcements, and set a trigger to reassess any flow whose decision is suspended or amended. Because the Commission has already reviewed some decisions, such as its first review of the Korea decision on 23 July 2026, your monitoring should track outcomes, not just the existence of the decision. Ask your legal team to define a fallback Article 46 mechanism in advance so that a suspension does not stop a business-critical flow overnight.
Which transfers rely on an adequacy decision, and which scoping choices change the work
Before a team can rely on Article 45, it has to settle a few parallel questions: where the data goes, who receives it, and whether a transfer is happening at all. Each answer changes which adequacy decision applies, how narrow the reliance is, and what monitoring the team owes afterwards.
Destination country or territory
Start by confirming the exact country or territory that receives the data, not the parent company's headquarters. The Commission's list covers specific jurisdictions, and some entries such as the Faroe Islands, Guernsey, the Isle of Man and Jersey are separate from their larger neighbors. Record the destination in the transfer register so the adequacy basis can be traced for each flow.
Sector or organization type
Some decisions cover only part of a destination's economy. Canada's recognition applies to commercial organizations subject to its private sector law, so a Canadian public body or an organization outside that scope does not benefit. Ask the recipient to confirm which regime applies to it and whether its activity falls within the recognized scope before relying on the decision.
US recipient Data Privacy Framework status
For United States recipients, adequacy depends on the importer being a current participant in the EU-US Data Privacy Framework, not on the country alone. Check the recipient's self-certification status, the scope of its certification, and whether the data types in the flow fall within what it has certified. A lapsed or narrower certification means the team needs another transfer basis for that flow.
International organization involvement
When a transfer goes to an international organization, the adequacy analysis may rest on a decision specific to that body rather than on a country. The European Patent Organisation is recognized under its own decision. Confirm that the recipient is the organization itself and not a national office, contractor or affiliate, since a decision for one body does not extend to others.
Onward transfers and third parties
A data flow to an adequate country often continues to other processors, sub-processors or cloud regions that sit outside it. Adequacy covers the receiving party's protection, not every downstream hop. Map each onward recipient and its location, and confirm whether the onward movement is covered by the same decision or needs a separate transfer tool.
Whether the flow is a transfer
Article 45 applies only when personal data is actually sent or made accessible to a recipient in a third country. Remote access from outside the EEA, a support engineer viewing a database, or a replicated backup stored abroad can each count as a transfer. Test each flow against who can see the data and where, because a flow that stays inside the EEA needs no adequacy analysis at all.
How an assessor tests the adequacy basis for a transfer
This table sets out each step an assessor takes to confirm that a transfer rests validly on an adequacy decision under Article 45, with the evidence requested and the findings that most often appear. Read it as a sequence: confirm the destination and decision first, then the recipient, then the actual transfer records, and finally the monitoring that keeps the basis valid.
| Test step | Evidence requested | Common findings |
|---|---|---|
| Destination on the list at the assessment date | The Commission's adequacy page or decision reference, dated to the assessment date, and the exporter's record of the country or sector relied on | Records cite a decision that has been repealed, amended or not yet adopted, or rely on a list from an earlier date |
| Decision scope matches the transfer | The operative part of the decision, showing whether it covers the whole country, a sector, or a specific category of organization | Transfer relies on a country-wide finding when the decision covers only commercial organizations or a named sector |
| Recipient status and eligibility | Current recipient status, such as Data Privacy Framework participation and its covered data categories, confirmed from the recipient in writing | Recipient has lapsed or never self-certified, or the data falls outside the categories the recipient covers |
| Data and onward transfer fit | Data inventory showing data categories and purposes, plus confirmation that onward transfers stay within the recipient's covered scope | Recipient's sub-processors or group entities receive data not described in the basis relied on |
| Sampled transfer records | A sample of transfer flows with the recipient, destination, data categories and the basis cited for each | Some flows are labeled adequacy but route through a non-covered country, or the cited basis is missing for a flow |
| Monitoring of decision validity | Dated checks of the decision's status, records of Commission reviews and any suspension or amendment, and who reviewed them | No monitoring record exists, or reviews stopped after the initial assessment |
| Fallback plan on withdrawal | Documented alternative transfer basis, such as standard contractual clauses, ready to apply if the decision is suspended | No alternative basis is documented, so a suspension would halt the flow without warning |
Steps to rely on an adequacy decision with confidence
This sequence lets an organization show, flow by flow, that a transfer to a third country rests on a valid Commission adequacy decision, and that it keeps that position as the decision is reviewed or changed. Each step produces a record that an assessor or supervisory authority can inspect.
Map transfers to recipients and destinations
Start with an inventory of every flow in which personal data leaves the EEA or becomes accessible from a third country, including remote support, backups, logs and sub-processors. The data protection team and system owners complete it together, and the output is a transfer register listing each exporter, importer, data category, purpose and destination country. The step is done when system owners have confirmed every entry, including flows that were not previously documented as transfers.
Match each flow to a decision and its scope
For each destination, identify whether the Commission has adopted an adequacy decision and read its scope carefully. Some decisions cover only commercial organizations, specified sectors, or a particular certification scheme, so a country on the list does not automatically cover every recipient. The output is a scope note per flow stating which decision applies and why the importer falls within it. Confirm the recipient qualifies before relying on it, and record any flow that falls outside every decision for handling under another transfer route.
Verify the recipient's status with the source
Check the current status of each decision against the Commission's own adequacy pages and the official text in the Official Journal, not against secondary summaries. For US importers relying on the Data Privacy Framework, confirm the organization is listed as an active participant at the time of transfer and that its certification covers the data in question. The output is a dated verification record with the source consulted and the person who checked it. Repeat this check on a fixed internal schedule, since participation and scope can change.
Record the legal basis per flow
Document, for every flow, that Article 45 is the legal basis and cite the specific decision relied on. Link the entry to the transfer register, the verification record and the relevant processing activity in the record of processing. Where a flow also involves onward transfers or a sub-processor outside the adequate destination, record the separate basis for that onward step. The output is a legal basis register that an assessor can read without contacting the team, and the step is complete when every flow in the transfer register has one entry.
Configure systems to filter and report by destination
Tag data stores, applications, regions and vendor services with their destination country so that transfers can be filtered and reported by destination and by decision. Ask self-hosted platform teams to confirm that hosting regions, replication targets and backup locations are visible in configuration and inventory, and that changes to them generate a log entry. The output is a destination report generated from system data, which should match the transfer register. Discrepancies between the report and the register are treated as open findings until resolved.
Set up monitoring of the decision and its review
Assign an owner to watch for changes to each adequacy decision, including Commission review outcomes, amendments, suspensions and court proceedings that may affect validity. Adequacy implementing acts must provide for periodic review at least every four years, and the Commission may repeal, amend or suspend a decision, so monitoring should be continuous rather than tied to a single date. The output is a monitoring log with the date of each check, the sources reviewed and any action taken. Update the legal basis register whenever a change is recorded.
Define a fallback route if a decision is suspended or repealed
Agree in advance which transfer tool will apply to each flow if its adequacy decision is suspended, amended or repealed. The usual candidates are the Article 46 safeguards, such as standard contractual clauses with a transfer impact assessment, or, where data can be kept within the EEA, relocating processing. Confirm with legal counsel which route is practical for each flow, and whether the chosen safeguard can be in place before the change takes effect. The output is a contingency plan per destination, tested through a tabletop exercise, that names the owners and the systems that would change.
Evidence that shows the adequacy basis still holds
An adequacy decision removes the need for a transfer tool, but only while the decision remains in force and the data flow stays within its scope. The artifacts below show that both conditions hold, and each one needs a named owner and a refresh routine between assessments.
Transfer register with legal basis
A register that lists every flow of personal data to a third country, the recipient, the destination, the data categories and the legal basis relied on for each flow. For Article 45 flows, the entry should name the specific Commission decision and the scope it covers, such as the whole country or a sector. Review the register whenever a new integration, vendor or sub-processor is added, and confirm that no flow has quietly moved to a destination outside the decision's coverage.
Dated copies of the decision
Keep a dated copy or a stable reference to the adequacy decision relied on, together with the date you last confirmed it was in force. Adequacy decisions can be repealed, amended or suspended, and changes take effect without retroactive effect, so the file should show what the decision said when each transfer began. Record the date of each check so an assessor can see the basis was current for every period under review.
Recipient status checks
Where an adequacy decision depends on the recipient's own participation, such as a US organization self-certified to the Data Privacy Framework, the status of that recipient is part of the basis. Keep dated screenshots or exports of the public listing for each recipient, and repeat the check on a fixed schedule as well as before onboarding. A recipient that has lapsed or been removed no longer falls within the decision, so the register entry must change at once.
Decision monitoring log
A log of every review, amendment, suspension or renewal affecting the decisions you rely on, with the date you learned of it, the assessment made and the action taken. Decisions must be reviewed periodically, at least every four years, and the Commission can change them at any time. Assign one owner to watch official announcements and record each outcome, so the log shows continuous monitoring rather than a single check at contract signing.
Configuration exports for data location
Exports from cloud consoles, identity systems and application settings that show where personal data is stored, replicated and backed up, and which accounts or support paths can reach it. These exports prove that the flow matches the register, including backup regions and remote administration from outside the covered destination. Export them on a schedule and compare each one with the register, because a changed region or a new support role can take a flow outside the decision.
Fallback plan with named owner
A documented plan for what happens if an adequacy decision is suspended or repealed, including which Article 46 or Article 49 tool would apply, which flows would need to move or stop, and the time needed to switch. Name an accountable owner and confirm the plan with legal counsel, since a fallback tool such as standard contractual clauses needs its own assessment before it can replace the decision. Test the plan against a sample flow at least once a year and record the result.
What relying on an adequacy decision costs in money and effort
This table compares the main cost components of relying on an Article 45 adequacy decision, showing who is paid, whether each cost is one-time or recurring, what drives it up and how to keep it down. Read it as a checklist for quotes and internal budgets, since no adequacy-specific price or duration is published in the supporting facts. The main takeaway is that the largest recurring cost is keeping destination records current, which is far cheaper when the transfer inventory is well organized from the start.
| Cost component | Who is paid or who bears it | One-time or recurring, and what drives it | How to keep it down |
|---|---|---|---|
| Initial mapping and legal review of transfers | Your staff, plus any outside counsel or consultant you engage | One-time at the outset, then updated when flows change. Driven by the number of data flows, systems and recipients in scope. | Start from one register of flows and recipients, and map only flows that leave the EEA. |
| System and configuration changes to tag and report destinations | Your engineering and platform teams, or an implementation partner under a fixed-scope agreement | One-time build, then recurring upkeep. Driven by the number of destinations, how many systems hold personal data, and whether tagging is manual. | Tag destinations at the data store or pipeline level, and confirm with your partner what the written scope includes. |
| Recipient status checks and monitoring of Commission updates | Your privacy or compliance function, and any monitoring tool or service you choose to buy | Recurring. Driven by how many adequacy destinations you rely on and whether any decision is sector-limited, which requires checking that the flow falls within the covered sector. | Check the Commission's adequacy page on a set schedule, and record who reviews changes and when. |
| Recipient status checks for US organizations (DPF participants) | Your privacy function, with the recipient's self-certification status confirmed independently | Recurring. Driven by the number of US recipients and by how often their certification status or scope changes. | Ask recipients for their current status, and keep dated evidence of each check. |
| Staff time for periodic reviews | Your internal staff, who absorb this cost | Recurring. The Commission must review each decision periodically, and your reviews should follow the same cadence. Driven by the number of destinations and the complexity of each flow. | Set one review calendar covering all destinations, and reuse the same evidence template for each one. |
| Response plan for a suspended or amended decision | Your legal and privacy team, possibly with outside counsel | Contingent, not scheduled. Driven by how many flows depend on a single decision, since the Commission can amend, suspend or repeal a decision. | Keep an alternative transfer basis documented for high-dependence flows, and know how changes would reach your systems. |
| External legal or consultant review (optional) | An outside law firm, privacy consultant or implementation partner, paid by the engagement | Optional, usually one-time for the initial review and occasional thereafter. Driven by the complexity of your flows and internal expertise. | Ask for a fixed-scope quote with named deliverables, and confirm whether any work is retained or charged per request. |
Your team, an implementation partner and the auditor each own a different part
Your organization remains the controller or processor that makes the transfer, so it owns every decision that establishes the legal basis. That means confirming that each data flow to a third country actually falls under an adequacy decision, recording the decision in your transfer register, and naming who watches for changes to that decision. No outside party can take these decisions over, and no partner's documentation replaces your own sign-off.
- Transfer decisions: Decide, for each flow, whether the destination and the recipient fall within the scope of the adequacy decision, such as a commercial organization in Canada or a US organization that is an active participant in the Data Privacy Framework.
- Legal basis per flow: Record the Article 45 basis in your records of processing, along with the date you checked it.
- Monitoring owner: Assign a named role, such as the data protection officer or the privacy lead, to track Commission reviews, repeals and amendments.
- Escalation path: Define what happens if a decision is suspended or the recipient drops off the list, including which flows stop and who approves the fallback.
- Sign-off record: Keep approvals and rationale on file, since the auditor will ask who made the call and on what information.
Check that each transfer has a named owner and a dated legal basis before you ask anyone else to build evidence for it.
A partner such as DeployOpen works inside your environment to make the transfer picture visible and provable. It can map where systems and data stores sit, configure data location and reporting settings in self-hosted platforms, assemble the evidence pack and set up monitoring workflows. It does not decide whether a destination is adequate, does not interpret the decision for your legal position, and does not issue opinions on compliance.
- System mapping: Trace which applications, backups, logs and support channels move personal data across borders, including remote administration from outside the EEA.
- Data location configuration: Set hosting regions, storage locations and access paths in the platforms you run, and document the settings.
- Evidence pack: Collect configuration exports, network diagrams, access records and change logs that show how each mapped flow behaves in practice.
- Monitoring workflows: Build alerts or review tasks that prompt your monitoring owner when a flow changes or a decision is reviewed.
- Documentation handover: Deliver the artifacts in a form your team and auditor can read, with a clear statement of what each item does not prove.
Before you engage a partner, confirm in the written scope which artifacts you will receive and that the legal conclusions stay with your team.
An independent auditor, or a supervisory authority in an investigation, tests the evidence and reaches its own findings. The GDPR does not require an audit or certificate for transfers, so a review happens only when you commission one, when a customer asks for one, or when a regulator investigates. Independence means the tester does not design the controls it examines, and that it reports its own conclusions rather than the conclusions you hoped for.
- Testing scope: The tester checks whether your transfer register matches the systems and flows in the evidence, and whether the legal basis is recorded correctly.
- Sampling and walkthroughs: Expect requests to see live configurations, sample flows end to end and interview the monitoring owner.
- Independent findings: Findings belong to the tester. Your partner's reports are inputs, not conclusions.
- Certification limits: Any Article 42 certification is voluntary, is issued for at most three years, and does not reduce your responsibility for compliance.
- Boundary: Your implementation partner cannot act as the auditor for the same engagement, and your team cannot treat an auditor's sample as proof that every flow is covered.
Before you commission a review, ask the auditor how it will separate its testing from any work your partner performed.
Where teams get adequacy reliance wrong
Adequacy decisions remove the need for a separate transfer tool, but only for the exact recipient, sector and period the Commission covered. The gaps below are the ones that most often leave a transfer unprotected without anyone noticing, and each comes with a check that closes it.
Treating a sector-limited decision as country-wide
Canada's adequacy recognition covers commercial organizations subject to its private sector privacy law, not every Canadian recipient. A public body, or a recipient outside the covered scope, does not inherit the decision. For each Canadian recipient, confirm it falls within the commercial scope the Commission describes, and record that finding against the specific entity, not the country name.
Assuming a US recipient is covered
The adequacy position for the United States depends on the recipient being a current participant in the EU-US Data Privacy Framework. A US vendor that has not self-certified, or whose certification has lapsed, is not covered by the decision. Check the recipient's participation status on the Data Privacy Framework list before each new flow, and keep a dated copy of the result in the transfer record.
Forgetting onward transfers by sub-processors
An adequate recipient may pass personal data to its own sub-processors, support centers or affiliates in other countries. The adequacy decision covers the first hop only. Map each sub-processor and its location, and confirm that every onward destination is either adequate or covered by a separate transfer mechanism. Ask the recipient for its current sub-processor list and written notice of changes.
Not recording the decision relied on
Adequacy is a moving reference point. When a transfer is challenged, the controller must show which decision applied, its date, and whether it was in force on the day the data moved. Store the decision name, the Commission's reference, the date you checked, and the recipient scope in each transfer record. Re-date the record whenever the basis is reconfirmed, so the history shows continuous reliance.
No monitoring of reviews or suspensions
Adequacy implementing acts must be reviewed periodically, at least every four years, and the Commission can amend, suspend or repeal them. A decision can change without any action from the exporter. Assign an owner to track Commission reviews, renewals and suspensions for every country your flows use, and set a trigger that reviews affected transfers when a change is announced. Check the Commission's adequacy page on a fixed schedule.
No fallback if a decision is suspended
Suspension or repeal of a decision does not necessarily stop the transfer from being unlawful on the day it takes effect, so waiting for an announcement is too late. Maintain a documented fallback for each adequacy-based flow, such as standard contractual clauses with a transfer impact assessment, prepared in advance and tested with the recipient. Confirm with counsel which fallback applies and how fast it can be put in place for each flow.
What buyers ask before relying on an adequacy decision
Is relying on an adequacy decision less work than using standard contractual clauses?
Yes, usually, because an adequacy decision removes the need for a transfer tool such as standard contractual clauses for that destination. The EDPB's Recommendations 01/2020 say that where an adequacy decision covers the destination, no further steps are needed other than monitoring that the decision remains valid. The effort shifts from drafting and assessing third-country law to monitoring. Your effort still depends on how precisely the decision covers your flow, since some decisions are limited to a sector or to organizations that have certified, such as US participants in the Data Privacy Framework. Confirm the scope of the decision against each flow before you rely on it.
Can a small team map transfers and check adequacy in-house?
A small team can usually do the mapping in-house if it has clear ownership of systems and access to the people who run them. The work has three parts: listing every flow of personal data to a non-EEA destination, including remote support and sub-processors, matching each flow to a decision, and recording the reliance and its monitoring. Legal interpretation of scope, such as whether a self-certified recipient covers your data, should sit with your counsel. Small teams often struggle with hidden flows, such as backups, logs and vendor support access, so plan time for that discovery step.
What does a partner need from us to start a transfer review?
A partner needs a transfer inventory, technical access to the systems that move or host personal data, and named owners who can answer for each system. The inventory should list the systems, the data categories, the origin and destination countries, the recipients and any sub-processors. Access lets the partner confirm where data actually goes, through configuration, logs or network records, rather than relying on documentation alone. Named owners resolve questions about purpose and business need. The scope is agreed in writing before work starts, and the list of inputs should appear in that scope.
How long does the work take if we have many data flows?
The timeline depends mainly on the number of flows, how many systems each flow touches, and how well the inventory already exists. More flows and more sub-processors extend discovery and verification, while a clean inventory shortens it. Most engagements are fixed-scope, so the agreed scope, deliverables and timeline are set in writing before work starts, and that agreement sets the timeline for your environment. Ask for a breakdown by flow group and by phase so you can see which parts depend on your internal owners.
What happens if the Commission suspends or repeals an adequacy decision?
If the Commission suspends or repeals a decision, transfers that relied on it need a different legal basis, and the change applies without retroactive effect. Article 45 allows the Commission to repeal, amend or suspend a decision, and Article 45 also requires periodic review at least every four years. Your contingency plan should name the fallback for each flow, such as standard contractual clauses under Article 46 with a supplementary measures assessment, and the time needed to switch. Monitoring the Commission's decisions and reviews is the early warning that makes this planning practical.
Can DeployOpen give us a legal opinion on whether a transfer is lawful?
No. DeployOpen prepares systems, controls and technical evidence for transfer reviews, but it does not provide legal opinions. Your organization owns its compliance decisions. Your counsel should interpret whether a destination, sector or recipient falls within an adequacy decision, and an independent auditor or assessor tests the controls where an assessment applies. A DeployOpen engagement can document where data flows and how systems are configured, so counsel and auditors have accurate facts to work from.
Does relying on an adequacy decision remove our security obligations?
No. Adequacy means the transfer itself needs no further authorization, but your obligations as controller or processor continue, including the security of processing under Article 32 and the transparency duties that cover recipients. You still need to know where data goes, control who can access it, and keep records. Confirm with counsel which obligations apply to your role and flows.
How DeployOpen works on this
DeployOpen helps organizations that rely on an adequacy decision for a transfer prepare the systems, configuration and records that show the reliance is documented and monitored. We work inside the client's own infrastructure and do not issue determinations, attestations or certificates, which remain the organization's responsibility and, where a report is needed, the job of an independent assessor.
How we scope
- Engagements are fixed-scope, with the destination countries, systems and data flows agreed in writing before work starts.
- The written scope names which transfers rely on an adequacy decision and which fall to another transfer tool.
- Scope also records who owns each monitoring task: the organization, its legal team or the DeployOpen team.
How we build
- We map where personal data leaves the EEA in the systems we deploy, including backups, logs and support access.
- We configure hosting, access controls and logging so the data location and the recipient of each flow can be shown.
- We test that the configuration matches the documented transfer map and record the results for the client.
How we hand over
- Deliverables include the transfer register entries, system diagrams and configuration records for each covered flow.
- We document the monitoring steps the client must perform, such as tracking Commission decisions and reviews for each destination.
- Handover covers a walkthrough with the team that will own the evidence after the engagement closes.
How we support
- Ongoing support, upgrades and continuous testing are available as retainers for systems that change over time.
- A retainer can cover updates to the transfer map when new systems, subprocessors or destinations are added.
- Before engaging, ask us to confirm the current status of each adequacy decision with your legal counsel or the Commission's published list.
