Data Protection Monitor
Global Privacy & Data Protection Intelligence

European Economic Area (EEA) · Module Detail

European Economic Area: Cross-Border & Adequacy

← Full European Economic Area overview Build report with European Economic Area Request deeper dive

#

Comprehensive Chapter V transfer architecture with 17 active European Commission adequacy decisions (including UK adequacy renewed on 19 December 2025 until 27 December 2031, European Patent Organisation adequacy in July 2025, and Brazil adequacy adopted 27 January 2026) and the EU–US Data Privacy Framework upheld by the General Court in Case T-553/23 Latombe v Commission (3 September 2025), balanced against active DPC/EDPB transfer enforcement (TikTok €530m fine, May 2025; Case T-354/22 Bindl v Commission, Jan 2025).

Primary frameworkGDPR Chapter V, Articles 44-50 (Regulation (EU) 2016/679)
Supervisory authorityEuropean Commission (adequacy decisions) with EDPB opinion role; national DPAs for SCC/BCR approval
Traffic-light rationale — AmberComprehensive Chapter V transfer architecture with 17 active European Commission adequacy decisions (including UK adequacy renewed on 19 December 2025 until 27 December 2031, European Patent Organisation adequacy in July 2025, and Brazil adequacy adopted 27 January 2026) and the EU–US Data Privacy Framework upheld by the General Court in Case T-553/23 Latombe v Commission (3 September 2025), balanced against active DPC/EDPB transfer enforcement (TikTok €530m fine, May 2025; Case T-354/22 Bindl v Commission, Jan 2025).

Sub-modules (6)

Category narrative309 words

Personal data circulates freely across all 30 EEA states under Art. 1(3) GDPR and EEA Joint Committee Decision No 154/2018. Outbound transfers to third countries or international organisations are governed by Chapter V (Arts. 44–50) GDPR. Under Art. 45 GDPR, the European Commission has adopted adequacy decisions covering Andorra, Argentina, Canada (PIPEDA commercial organisations), Faroe Islands, Guernsey, Israel, Isle of Man, Japan, Jersey, New Zealand, Republic of Korea, Switzerland, the United Kingdom (renewed on 19 December 2025 by Implementing Decisions (EU) 2025/2545 and (EU) 2025/2546 for six years until 27 December 2031, and incorporated into the EEA Agreement by EEA Joint Committee Decision No 37/2026 on 20 February 2026), the United States (EU–US Data Privacy Framework, Implementing Decision (EU) 2023/1795, upheld by the EU General Court on 3 September 2025 in Case T-553/23 Latombe v Commission and pending appeal in Case C-715/25 P), Uruguay, the European Patent Organisation (Implementing Decision (EU) 2025/1382 of 15 July 2025 — first Art. 45 adequacy decision for an international organisation), and Brazil (mutual adequacy decision adopted 27 January 2026). Where no adequacy decision applies, exporters must implement Art. 46 appropriate safeguards — primarily the 2021 Standard Contractual Clauses (Decision (EU) 2021/914, to be supplemented by the Commission's dedicated Module 5 SCCs for third-country controllers/processors already directly subject to Art. 3(2) GDPR) or Binding Corporate Rules (Art. 47) — supported by a Schrems II Transfer Impact Assessment (TIA) and supplementary technical measures, alongside Art. 48 blocking restrictions against non-treaty third-country foreign-authority disclosure orders (EDPB Guidelines 02/2024 of 2 December 2024). Active transfer enforcement includes the Irish DPC's €530 million fine against TikTok (2 May 2025) for remote access to EEA user data from China and the General Court's award of €400 non-material damages in Case T-354/22 Bindl v Commission (8 January 2025) for unlawful transfer of IP/browser data to the US via Facebook Login.

Sources and claims (8)
  1. ConfirmedEDPB — Article 46 GDPR lists appropriate-safeguards transfer tools (including SCCs and BCRs), and Article 49 provides derogations for specific situations, both usable absent an adequacy decision, subject to the exporter maintaining Article 5 GDPR compliance.observed
  2. ConfirmedICO — The GDPR framework positions the European Commission as the body issuing adequacy decisions under Article 45 to third countries (e.g. the UK, renewed 19 December 2025 to run until 27 December 2031); the EEA itself is not a recipient of inbound adequacy findings under this mechanism.observed
  3. ConfirmedEDPB — The European Commission has recognised adequate third countries/territories including Andorra, Argentina, Canada, the Faroe Islands, Guernsey, Israel, Isle of Man, Japan, Jersey, New Zealand, South Korea, Switzerland, the United Kingdom, Uruguay and the United States.observed
  4. ConfirmedIAPP — The EU-US Data Privacy Framework adequacy decision, adopted 10 July 2023, allows personal data to flow to certified US organisations without additional transfer safeguards; as of early 2026 more than 3,500 US companies had self-certified, though the framework remains subject to potential CJEU review and EDPB monitoring including a first-review report.observed
  5. ConfirmedBfDI — The European Commission adopted modernised Standard Contractual Clauses via Implementing Decision (EU) 2021/914 in June 2021, and since 27 September 2021 only the current SCCs may be used for new transfer contracts; the EDPB continues to issue opinions approving Member State DPAs' draft BCR authorisations (e.g. multiple 2026 opinions on Dutch SA BCR decisions).observed
  6. ConfirmedCNIL — A Transfer Impact Assessment must be carried out by an exporter relying on an Article 46 GDPR transfer tool prior to transferring data to a third country, unless the destination is covered by an adequacy decision or an Article 49 derogation applies.observed
  7. ProbableEuropean Commission — A separate EU legislative proposal for sovereign cloud computing services (impact assessment submitted to the Regulatory Scrutiny Board, positive opinion 8 May 2026) introduces safeguards for EU-citizen personal data processed via cloud infrastructure and is framed as complementary to, not a replacement for, the GDPR and EU-US DPF transfer regime.observed
  8. Probableunavailable — EU UK adequacy decision (Implementing Decision (EU) 2021/1772) grants adequacy: Does not cover Gibraltar, including under its December 2025 renewal to 27 December 2031; Gibraltar is not deemed adequate by the European Commission.