--- title: "European Economic Area — Cross-Border & Adequacy | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/european-economic-area-bloc/cross-border-and-adequacy/ source_html: /jurisdictions/european-economic-area-bloc/cross-border-and-adequacy/index.html description: "European Economic Area (Bloc) — Cross-Border & Adequacy (Amber, 6 sub-modules, 8 claims): Comprehensive Chapter V transfer architecture with 17 active European Commission adequacy decisions (including UK adequacy renewed on 19 December 2025" generated_at: 2026-10-25T04:46:50Z content_sha256: 9668fc659f889723a442a3669853a2bea09f27ac1f98f564f049dd4dc8f15183 generator: "fe-fleet/md-twin@1.0" --- # European Economic Area — Cross-Border & Adequacy | Data Protection Monitor ### D5Cross-Border & Adequacy6 sub-modules8 claimsAmber▾# Comprehensive Chapter V transfer architecture with 17 active European Commission adequacy decisions (including UK adequacy renewed on 19 December 2025 until 27 December 2031, European Patent Organisation adequacy in July 2025, and Brazil adequacy adopted 27 January 2026) and the EU–US Data Privacy Framework upheld by the General Court in Case T-553/23 Latombe v Commission (3 September 2025), balanced against active DPC/EDPB transfer enforcement (TikTok €530m fine, May 2025; Case T-354/22 Bindl v Commission, Jan 2025). Primary framework GDPR Chapter V, Articles 44-50 (Regulation (EU) 2016/679) Supervisory authority [European Commission (adequacy decisions) with EDPB opinion role; national DPAs for SCC/BCR approval](https://www.edpb.europa.eu/our-work-tools/our-documents/topic/adequacy-decision_en) Traffic-light rationale — Amber Comprehensive Chapter V transfer architecture with 17 active European Commission adequacy decisions (including UK adequacy renewed on 19 December 2025 until 27 December 2031, European Patent Organisation adequacy in July 2025, and Brazil adequacy adopted 27 January 2026) and the EU–US Data Privacy Framework upheld by the General Court in Case T-553/23 Latombe v Commission (3 September 2025), balanced against active DPC/EDPB transfer enforcement (TikTok €530m fine, May 2025; Case T-354/22 Bindl v Commission, Jan 2025). #### Sub-modules (6) Category narrative 309 words Personal data circulates freely across all 30 EEA states under Art. 1(3) GDPR and EEA Joint Committee Decision No 154/2018. Outbound transfers to third countries or international organisations are governed by Chapter V (Arts. 44–50) GDPR. Under Art. 45 GDPR, the European Commission has adopted adequacy decisions covering Andorra, Argentina, Canada (PIPEDA commercial organisations), Faroe Islands, Guernsey, Israel, Isle of Man, Japan, Jersey, New Zealand, Republic of Korea, Switzerland, the United Kingdom (renewed on 19 December 2025 by Implementing Decisions (EU) 2025/2545 and (EU) 2025/2546 for six years until 27 December 2031, and incorporated into the EEA Agreement by EEA Joint Committee Decision No 37/2026 on 20 February 2026), the United States (EU–US Data Privacy Framework, Implementing Decision (EU) 2023/1795, upheld by the EU General Court on 3 September 2025 in Case T-553/23 Latombe v Commission and pending appeal in Case C-715/25 P), Uruguay, the European Patent Organisation (Implementing Decision (EU) 2025/1382 of 15 July 2025 — first Art. 45 adequacy decision for an international organisation), and Brazil (mutual adequacy decision adopted 27 January 2026). Where no adequacy decision applies, exporters must implement Art. 46 appropriate safeguards — primarily the 2021 Standard Contractual Clauses (Decision (EU) 2021/914, to be supplemented by the Commission's dedicated Module 5 SCCs for third-country controllers/processors already directly subject to Art. 3(2) GDPR) or Binding Corporate Rules (Art. 47) — supported by a Schrems II Transfer Impact Assessment (TIA) and supplementary technical measures, alongside Art. 48 blocking restrictions against non-treaty third-country foreign-authority disclosure orders (EDPB Guidelines 02/2024 of 2 December 2024). Active transfer enforcement includes the Irish DPC's €530 million fine against TikTok (2 May 2025) for remote access to EEA user data from China and the General Court's award of €400 non-material damages in Case T-354/22 Bindl v Commission (8 January 2025) for unlawful transfer of IP/browser data to the US via Facebook Login. Evidence 8 Sources and claims (8) - Confirmed[EDPB](https://www.edpb.europa.eu/sme-data-protection-guide/international-data-transfers_en) — Article 46 GDPR lists appropriate-safeguards transfer tools (including SCCs and BCRs), and Article 49 provides derogations for specific situations, both usable absent an adequacy decision, subject to the exporter maintaining Article 5 GDPR compliance.observed 2026-08-05 - Confirmed[ICO](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-transfers/receiving-personal-information-from-the-eea/) — The GDPR framework positions the European Commission as the body issuing adequacy decisions under Article 45 to third countries (e.g. the UK, renewed 19 December 2025 to run until 27 December 2031); the EEA itself is not a recipient of inbound adequacy findings under this mechanism.observed 2026-08-05 - Confirmed[EDPB](https://www.edpb.europa.eu/news/news/2024/edpb-meets-adequate-countries_en) — The European Commission has recognised adequate third countries/territories including Andorra, Argentina, Canada, the Faroe Islands, Guernsey, Israel, Isle of Man, Japan, Jersey, New Zealand, South Korea, Switzerland, the United Kingdom, Uruguay and the United States.observed 2026-08-05 - Confirmed[IAPP](https://iapp.org/news/a/iapp-global-summit-2026-on-the-state-of-the-trans-atlantic-data-transfer-agreement) — The EU-US Data Privacy Framework adequacy decision, adopted 10 July 2023, allows personal data to flow to certified US organisations without additional transfer safeguards; as of early 2026 more than 3,500 US companies had self-certified, though the framework remains subject to potential CJEU review and EDPB monitoring including a first-review report.observed 2026-08-05 - Confirmed[BfDI](https://www.bfdi.bund.de/EN/Fachthemen/Inhalte/Europa-Internationales/Internationaler_Datentransfer.html) — The European Commission adopted modernised Standard Contractual Clauses via Implementing Decision (EU) 2021/914 in June 2021, and since 27 September 2021 only the current SCCs may be used for new transfer contracts; the EDPB continues to issue opinions approving Member State DPAs' draft BCR authorisations (e.g. multiple 2026 opinions on Dutch SA BCR decisions).observed 2026-08-05 - Confirmed[CNIL](https://www.cnil.fr/sites/cnil/files/2025-01/guide_tia.pdf) — A Transfer Impact Assessment must be carried out by an exporter relying on an Article 46 GDPR transfer tool prior to transferring data to a third country, unless the destination is covered by an adequacy decision or an Article 49 derogation applies.observed 2026-08-05 - Probable[European Commission](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A52026PC0502) — A separate EU legislative proposal for sovereign cloud computing services (impact assessment submitted to the Regulatory Scrutiny Board, positive opinion 8 May 2026) introduces safeguards for EU-citizen personal data processed via cloud infrastructure and is framed as complementary to, not a replacement for, the GDPR and EU-US DPF transfer regime.observed 2026-08-05 - Probableunavailable — EU UK adequacy decision (Implementing Decision (EU) 2021/1772) grants adequacy: Does not cover Gibraltar, including under its December 2025 renewal to 27 December 2031; Gibraltar is not deemed adequate by the European Commission.