Adequacy is the easy road
A transfer to a third country is free of further conditions where the Commission has issued an adequacy decision for it. The transfer still needs a lawful basis and everything else in the regulation — adequacy removes only the transfer-specific hurdle.
Why it is like this
Rather than have each exporter assess each country, one assessment is made centrally and reused. It can also be withdrawn centrally, which is what makes it reviewable.
Not to be confused with
Permanent, or a general endorsement of the country. Adequacy decisions are periodically reviewed and have been annulled twice for the United States — and some cover only part of a country, or only certified organisations.
In practice
Japan, the UK, Switzerland and South Korea hold adequacy. The US is covered only through the Data Privacy Framework, and only for organisations that are certified under it.
Source: Regulation (EU) 2016/679 (GDPR) — Article 45. Read on .
Predict Check yourself
A processor in the United States is not certified under the Data Privacy Framework. Can you rely on the US adequacy decision for it?
Show the answer
No — that decision covers only certified organisations, so this transfer needs SCCs or another Article 46 tool.
Partial adequacy is the norm for the US. Checking the certification, and the scope of it, is part of the transfer assessment.