Article 45 of the GDPR: Adequacy decisions
Article 45 of the GDPR: Adequacy decisions
Summary
Article 45 of the GDPR defines the framework for adequacy decisions taken by the European Commission. These decisions recognize that a third country offers a level of protection of personal data equivalent to that of the EU.
Article 45 of the GDPR explained
An adequacy decision allows data controllers and subcontractors to freely transfer personal data to this country, without additional formality. The European Commission evaluates several criteria:
- Rule of law, respect for human rights and sectoral legislation;
- Existence of an independent data protection authority;
- International commitments of the third country (e.g. conventions, agreements...).
Decisions can be revised or repealed if the level of protection is no longer guaranteed.
Why is this article important for your GDPR compliance?
Article 45 simplifies data transfers to certain countries. It constitutes one major operational and legal leverage for internationalized companies. Using these decisions makes it possible to secure exchanges and gain efficiency.
How to comply with Article 45 of the GDPR?
- Consult the list of countries benefiting from an adequacy decision on the European Commission website;
- Identify your transfers to these countries and document them in your register;
- Check that the processing in question complies with the principles of the GDPR;
- Monitor possible developments (revision, suspension, withdrawal of the decision).
Examples of application of Article 45 of the GDPR
- French company transfers data to Japan, covered by adequacy decision;
- University cooperates with Canada and shares student registration files;
- An e-commerce site exchanges customer data with a service provider in South Korea (recently deemed adequate).
Related Resources
Accelerate your compliance in just a few clicks
With our all-in-one solution, you can accelerate and ensure compliance easily:
- Automate your compliance with our GDPR software
- Supported or outsourced by our DPO experts
- Raise awareness among your teams with our GDPR training e-learning
Assess your situation in 15 minutes with our free, no-obligation GDPR self-diagnosis.
