What is adequacy, and which countries have it?

What it is

Adequacy works in two directions. UK adequacy regulations govern transfers out of the UK. EU adequacy decisions for the UK, renewed on 2025-12-19 until 2031-12-27, govern transfers from the EU into the UK.

When adequacy applies

• The destination, and where relevant the sector or recipient, is covered by UK adequacy regulations. UK GDPR Art 45
• For the United States, only to organisations certified to the UK Extension of the EU-US Data Privacy Framework. Data Protection (Adequacy) (United States of America) Regulations 2023

Who is responsible

The exporter, which must check the scope of the regulations for the destination and recipient.

What it involves

1. Look up the destination.
2. Check any partial scope, such as commercial organisations only.
3. Record reliance on adequacy.
4. Monitor changes.

If it goes wrong

Regulatory

Transferring on adequacy that does not cover the recipient is an unlawful transfer. A breach sits in the higher tier of penalties: up to £17.5 million or 4% of annual worldwide turnover, whichever is higher (DPA 2018 s.157). The regulator can also issue a reprimand or an enforcement notice ordering the processing to stop or change.

Criminal

No offence.

Civil

Anyone who suffers material or non-material damage, including distress, because of the infringement can claim compensation from the controller or processor in the county court or High Court (sheriff court or Court of Session in Scotland) under Art 82 and DPA 2018 s.168.