Adequacy decision
CIPP/E glossary · Last reviewed: · By Victor Humenhuk (CIPP/E certified)
Adequacy decision - A European Commission determination that a third country's protection is essentially equivalent to the EU's, removing the need for extra transfer safeguards.
In the CIPP/E body of knowledge, Adequacy decision comes up under Ch 1.9 - Brexit, UK GDPR & adequacy; Ch 12.1 - Limitations on international transfers; Ch 12.6-12.9 - Mechanisms compared & outlook.
Adequacy decision in context
- As a ==third country==, the UK needed an ==adequacy decision==; the Commission adopted ==two adequacy decisions on 28 June 2021== (under the GDPR and the LED), uniquely subject to a ==four-year 'sunset clause'==. (Brexit and UK data protection)
- A transfer to a [[third country]] (or an [[international organisation]]) is only lawful if one of three conditions in [[Chapter 5 of the GDPR]] is met: an [[adequacy decision]], [[appropriate safeguards]], or a [[derogation]]. (The general restriction on transfers outside the EEA)
- ==The UK adequacy decision automatically expires 27 June 2025== unless extended. (Procedure to designate adequate countries)
Where Adequacy decision is covered in the CIPP/E study notes
- Brexit and UK data protection
- The general restriction on transfers outside the EEA
- Comparing the transfer mechanisms & the future of restrictions
- Offshoring and international transfers
- Module 7 · The landscape: three options in order
- Module 7 · Adequacy decisions & the Schrems/DPF saga
Related terms
- UK GDPR
- Exit Regulations
- Data Protection Act 2018
- Sunset clause
- Third country
- International organisation
- Chapter 5 of the GDPR
- Appropriate safeguards
- Derogation
- Standard contractual clauses
Test yourself on Adequacy decision
Recognising a definition is not the same as applying it in an exam scenario. Work through the free CIPP/E practice questions, or read the full CIPP/E study guide - every study note is free.