Adequacy Decision

Pre-approved legal contract templates issued by the European Commission that provide adequate safeguards for data protection when transferring personal data to a third country. In the absence of an adequacy decision, SCCs are the most common transfer mechanism. Following Schrems II, organizations must conduct a Transfer Impact Assessment to verify the clauses provide effective protection in practice, often requiring supplementary technical measures like end-to-end encryption.

A mandatory risk assessment required before transferring personal data to a third country, even when using SCCs. The TIA evaluates whether the destination country's surveillance laws and government access regimes undermine the contractual safeguards. Key steps include:

• Mapping the specific data flows and categories
• Analyzing local laws that may impinge on data protection
• Identifying supplementary measures (encryption, pseudonymization, access controls) to close any protection gaps

The landmark 2020 Court of Justice of the European Union (CJEU) decision that invalidated the EU-US Privacy Shield framework. The ruling established that data exporters must verify, on a case-by-case basis, whether the law of the destination country ensures essentially equivalent protection to GDPR. This decision elevated the importance of adequacy decisions and made TIAs a practical necessity for any transfer relying on SCCs.

Legally binding internal data protection policies for multinational corporate groups that govern intra-organizational transfers to countries without an adequacy decision. BCRs must be approved by a competent Data Protection Authority (DPA) and cover all group entities. Unlike SCCs, BCRs provide a holistic compliance framework for ongoing global operations but require significant legal investment to draft and gain approval.

A strict regulatory mandate requiring data to remain within a nation's borders, often prohibiting any cross-border transfer regardless of safeguards. Unlike an adequacy decision—which enables free flow—data localization represents the opposite extreme. Countries like Russia and China enforce strict localization for certain data categories. This creates architectural challenges requiring geo-partitioned databases and in-country infrastructure deployment.

A mandatory risk assessment under Article 35 of GDPR required when processing activities are likely to result in high risk to individuals. When transferring data internationally, a DPIA often intersects with the TIA process. The DPIA evaluates:

• The necessity and proportionality of the processing
• Risks to data subject rights and freedoms
• Mitigation measures including encryption at rest and in transit
• Whether an adequacy decision or other safeguard applies to the transfer destination