An EU adequacy decision is the cleanest transfer mechanism there is: data flows from the EEA to the listed destination as if it never left. The list is short, politically earned, and periodically reviewed. The Commission's January 2024 review reaffirmed the eleven pre-GDPR decisions, the UK's renewal runs to December 27, 2031, and in July 2025 the European Patent Organisation became the first international organisation on the list.
The EU adequacy list
- Andorra
- Argentina
- Canada (commercial organizations under PIPEDA)
- European Patent Organisation (the first international organisation found adequate, July 2025)
- Faroe Islands
- Guernsey
- Isle of Man
- Israel
- Japan
- Jersey
- New Zealand
- South Korea
- Switzerland
- United Kingdom
- United States (companies certified to the EU-US Data Privacy Framework)
- Uruguay
The US entry covers only companies certified to the Data Privacy Framework, so vendor-by-vendor verification still matters. Argentina and Uruguay remain the only Latin American holders, which is why Brazilian and Mexican data flows still ride on contract clauses. The Commission published a draft adequacy decision for Brazil in September 2025, and adoption would change that.
Other adequacy regimes
The UK maintains its own list (inherited from the EU, plus additions) and its own transfer tools. Japan and Korea hold mutual arrangements with the EU. Brazil's ANPD, Switzerland's Federal Council, Israel and others keep national lists, and the UK-US "data bridge" extends the DPF model. Adequacy works as bilateral plumbing, so a destination can be adequate for one origin and restricted for another.