According article 45 of GDPR and article 36 LED, a transfer of personal data to a third country or an international organisation may take place where the Commission has decided that the third country, a territory or one or more specified sectors within that third country, or the international organisation in question ensures an adequate level of protection. Such a transfer shall not require any specific authorisation.

Commission has adopted adequacy decision according GDPR for:

• Japan Commission decision 2019/419
• United Kingdom Commission decision 2021/1772
• Republic of Korea Commission decision 2022/254
• EU-US Data Privacy Framework Commission decision 2023/1795

Commission has adopted adequacy decision according LED for:

·United Kingdom Commission decision 2021/1773

Commission has adopted adequacy decision according Directive 95/46/ES for (decisions shall remain in force until amended, replaced or repealed by a Commission Decision):

• Andorra Commission decision 2010/625/EU  
• Argentina Commission decision 2003/490/EC
• Faeroe Islands Commission decision 2010/146/EU
• Guernsey Commission decision 2003/821/EC  
• State of Israel Commission decision 2011/61/EU  
• Jersey Commission decision 2008/393/EC  
• New Zealand Commission decision 2013/65/EU  
• Canada Commission decision 2002/2/EC  
• Isle of Man Commission decision 2004/411/EC  
• Switzerland Commission decision 2000/518/EC  
• Eastern Republic of Uruguay Commission decision 2012/484/EU  

See also Commission Implementing Decision (EU) 2016/2295 of 16 December 2016 amending Decisions 2000/518/EC, 2002/2/EC, 2003/490/EC, 2003/821/EC, 2004/411/EC, 2008/393/EC, 2010/146/EU, 2010/625/EU, 2011/61/EU and Implementing Decisions 2012/484/EU, 2013/65/EU on the adequate protection of personal data by certain countries, pursuant to Article 25(6) of Directive 95/46/EC of the European Parliament and of the Council.