Full text
The Commission, after assessing the adequacy of the level of protection, may decide, by means of implementing act, that a third country, a territory or one or more specified sectors within a third country, or an international organisation ensures an adequate level of protection within the meaning of paragraph 2 of this Article. The implementing act shall provide for a mechanism for a periodic review, at least every four years, which shall take into account all relevant developments in the third country or international organisation. The implementing act shall specify its territorial and sectoral application and, where applicable, identify the supervisory authority or authorities referred to in point (b) of paragraph 2 of this Article. The implementing act shall be adopted in accordance with the examination procedure referred to in Article 93(2).
How it connects
Cited by
- Guidelines 2/2018 on derogations of Article 49 under Regulation 2016/679
- Guidelines 07/2020 on the concepts of controller and processor in the GDPR
- Guidelines 07/2022 on certification as a tool for transfers
- hier
- Opinion 5/2025 on the draft decision of the Finnish Supervisory Authority regarding the Processor Binding Corporate Rules of the Nokia Group
All 102
- Opinion 07/2025 regarding the European Commission Draft Implementing Decision pursuant to Regulation (EU) 2016/679 on the adequate protection of personal data by the European Patent Organisation
- Opinion 9/2025 on the draft decision of the French Supervisory Authority regarding the Processor Binding Corporate Rules of the Worldline Group
- Opinion 20/2025 on the draft decision of the Luxembourg Supervisory Authority regarding the Processor Binding Corporate Rules of the Northern Trust Group
- Opinion 18/2025 on the draft decision of the Irish Supervisory Authority regarding the Processor Binding Corporate Rules of the Shopify Group
- Opinion 17/2025 on the draft decision of the Irish Supervisory Authority regarding the Controller Binding Corporate Rules of the Shopify Group
- Opinion 29/2025 on the draft decision of the Dutch Supervisory Authority regarding the Controller Binding Corporate Rules of the Illumina Group
- Opinion 30/2025 on the draft decision of the Dutch Supervisory Authority regarding the Processor Binding Corporate Rules of the Illumina Group
- Opinion 31/2025 on the draft decision of the Dutch Supervisory Authority regarding the Controller Binding Corporate Rules of the Arcadis Group
- Opinion 32/2025 on the draft decision of the Irish Supervisory Authority regarding the Controller Binding Corporate Rules of the CSG Group
- Opinion 33/2025 on the draft decision of the Irish Supervisory Authority regarding the Processor Binding Corporate Rules of the CSG Group
- Data Protection Commissioner v Facebook Ireland and Maximillian Schrems
- Opinion 4/2026 on the draft decision of the Dutch Supervisory Authority regarding the Controller Binding Corporate Rules of the ABB Group
- Opinion 1/2026 on the draft decision of the Dutch Supervisory Authority regarding the Controller Binding Corporate Rules of the Heineken Group
- If it ain’t broke, don’t fix it? Ten improvements for the upcoming tenth anniversary of the General Data Protection Regulation
- Opinion 21/2026 on the draft decision of the Irish Supervisory Authority regarding the Controller Binding Corporate Rules of the Flutter Group
- Opinion 20/2026 on the draft decision of the Dutch Supervisory Authority regarding the Controller Binding Corporate Rules of the Fluor Group
- Opinion 19/2026 on the draft decision of the Dutch Supervisory Authority regarding the Processor Binding Corporate Rules of the Rubrik Group
- Opinion 18/2026 on the draft decision of the Dutch Supervisory Authority regarding the Controller Binding Corporate Rules of the Rubrik Group
- Opinion 16/2026 on the draft decision of the Dutch Supervisory Authority regarding the Controller Binding Corporate Rules of the Infor Group
- Opinion 17/2026 on the draft decision of the Dutch Supervisory Authority regarding the Processor Binding Corporate Rules of the Infor Group
- Opinion 9/2026 on the draft decision of the Dutch Supervisory Authority regarding the Controller Binding Corporate Rules of the Jacobs Douwe Egberts Group
- Opinion 10/2026 on the draft decision of the Dutch Supervisory Authority regarding the Controller Binding Corporate Rules of the SLB Group
- Opinion 12/2026 on the draft decision of the Spanish Supervisory Authority regarding the Controller Binding Corporate Rules of the Santander Group
- Opinion 11/2026 on the draft decision of the Belgian Supervisory Authority regarding the Controller Binding Corporate Rules of the Kuwait Petroleum Group
- Opinion 15/2026 on the Europrivacy certification criteria regarding their approval by the Board as European Data Protection Seal to be used as tool for transfers pursuant to Articles 42 and 46 GDPR
- Opinion 8/2026 on the draft decision of the Dutch Supervisory Authority regarding the Controller Binding Corporate Rules of the IBM Group
- Opinion 7/2026 on the draft decision of the Dutch Supervisory Authority regarding the Controller Binding Corporate Rules of the BCD Travel Group
- Opinion 06/2026 on the draft decision of the Dutch Supervisory Authority regarding the Controller Binding Corporate Rules of the ABN AMRO Bank Group
- Opinion 5/2026 on the draft decision of the Dutch Supervisory Authority regarding the Processor Binding Corporate Rules of the Arcadis Group
- Opinion 23/2025 on the draft decision of the French Supervisory Authority regarding the Controller Binding Corporate Rules of the Tessi Group
- Opinion 25/2025 on the decision of the Polish Supervisory Authority regarding the Processor Binding Corporate Rules of the BOX Group
- Opinion 24/2025 on the decision of the Polish Supervisory Authority regarding the Controller Binding Corporate Rules of the BOX Group
- Opinion 13/2025 on the draft decision of the Dutch Supervisory Authority regarding the Controller Binding Corporate Rules of the Aramex Group
- Opinion 25/2024 on the draft decision of the Hesse Supervisory Authority (Germany) regarding the Processor Binding Corporate Rules of the Infosys Group
- Opinion 21/2024 on the draft decision of the French Supervisory Authority regarding the Processor Binding Corporate Rules of the Talan Group
- Opinion 14/2024 on the draft decision of the Estonian Supervisory Authority regarding the Processor Binding Corporate Rules of the Mercans Group
- Opinion 15/2024 on the draft decision of the Spanish Supervisory Authority regarding the Processor Binding Corporate Rules of the AVATURE Group
- Opinion 9/2024 on the draft decision of the Romanian Supervisory Authority regarding the Processor Binding Corporate Rules of the Genpact Group
- Opinion 3/2024 on the draft decision of the Irish Supervisory Authority regarding the Processor Binding Corporate Rules of the Accenture Group
- Opinion 2/2024 on the draft decision of the Spanish Supervisory Authority regarding the Controller Binding Corporate Rules of the TELEFÓNICA Group
- Opinion 01/2024 on the draft decision of the Dutch Supervisory Authority regarding the Processor Binding Corporate Rules of the Booking.com Group
- Opinion 36/2023 on the draft decision of the Dutch Supervisory Authority regarding the Controller Binding Corporate Rules of the Booking.com Group
- Opinion 34/2023 on the draft decision of the Hesse Supervisory Authority (Germany) regarding the Processor Binding Corporate Rules of the Cerner Group
- Opinion 35/2023 on the draft decision of the Danish Supervisory Authority regarding the Controller Binding Corporate Rules of the Carlsberg Group
- Opinion 33/2023 on the draft decision of the Hesse Supervisory Authority (Germany) regarding the Controller Binding Corporate Rules of the Cerner Group
- Opinion 29/2023 on the draft decision of the French Supervisory Authority regarding the Controller Binding Corporate Rules of the Sodexo Group
- Opinion 30/2023 on the draft decision of the French Supervisory Authority regarding the Processor Binding Corporate Rules of the Sodexo Group
- Opinion 27/2023 on the draft decision of the French Supervisory Authority regarding the Processor Binding Corporate Rules of the Tessi Group
- Opinion 28/2023 on the draft decision of the French Supervisory Authority regarding the Controller Binding Corporate Rules of the Servier Group
- Opinion 31/2023 on the draft decision of the French Supervisory Authority regarding the Controller Binding Corporate Rules of the Thalès Group
- Opinion 32/2023 on the draft decision of the French Supervisory Authority regarding the Processor Binding Corporate Rules of the Thalès Group
- Opinion 21/2023 on the draft decision of the Belgian Supervisory Authority regarding the Processor Binding Corporate Rules of the UPS Group
- Opinion 23/2023 on the draft decision of the Belgian Supervisory Authority regarding the Controller Binding Corporate Rules for customer data of the UPS Group
- Opinion 19/2023 on the draft decision of the Dutch Supervisory Authority regarding the Controller Binding Corporate Rules of the American Express Global Business Travel Group
- Opinion 20/2023 on the draft decision of the Dutch Supervisory Authority regarding the Controller Binding Corporate Rules of the Comcast Corporation Group
- Opinion 24/2023 on the draft decision of the French Supervisory Authority regarding the Controller Binding Corporate Rules of the Nestlé Group
- Opinion 22/2023 on the draft decision of the Belgian Supervisory Authority regarding the Controller Binding Corporate Rules for employee data of the UPS Group
- Opinion 25/2023 on the draft decision of the Dutch Supervisory Authority regarding the Controller Binding Corporate Rules of the SHV Holding N.V. Group
- Opinion 18/2023 on the draft decision of the Belgian Supervisory Authority regarding the Processor Binding Corporate Rules of the Collibra Group
- Opinion 16/2023 on the draft decision of the Irish Supervisory Authority regarding the Controller Binding Corporate Rules of the Informatica Group
- Opinion 17/2023 on the draft decision of the Irish Supervisory Authority regarding the Processor Binding Corporate Rules of the Informatica Group
- Opinion 14/2023 on the draft decision of the Danish Supervisory Authority regarding the Controller Binding Corporate Rules of the Vestas Wind Systems Group
- Statement 1/2023 on the first review of the functioning of the adequacy decision for Japan
- Opinion 10/2023 on the draft decision of the Spanish Supervisory Authority regarding the Controller Binding Corporate Rules of the PROSEGUR Group
- Opinion 9/2023 on the draft decision of the Italian Supervisory Authority regarding the Controller Binding Corporate Rules of Vertiv
- Opinion 7/2023 on the draft decision of the Irish Supervisory Authority regarding the Controller Binding Corporate Rules of Autodesk Group
- Opinion 8/2023 on the draft decision of the Irish Supervisory Authority regarding the Processor Binding Corporate Rules of Autodesk Group
- Opinion 6/2023 on the draft decision of the Danish Supervisory Authority regarding the Controller Binding Corporate Rules of Royal Greenland Group
- Opinion 26/2022 on the draft decision of the Data Protection Authority of Bavaria for the Private Sector regarding the Controller Binding Corporate Rules of the Munich Re Reinsurance Group
- Opinion 23/2022 on the draft decision of the Swedish Supervisory Authority regarding the Controller Binding Corporate Rules of the Samres Group
- Opinion 22/2022 on the draft decision of the Liechtenstein Supervisory Authority regarding the Controller Binding Corporate Rules of Hilti Group
- Opinion 21/2022 on the draft decision of the Irish Supervisory Authority regarding the Processor Binding Corporate Rules of the Ellucian Group
- Opinion 17/2022 on the draft decision of the Spanish Supervisory Authority regarding the Controller Binding Corporate Rules of the ANTOLIN Group
- Statement 02/2022 on personal data transfers to the Russian Federation
- EDPB-EDPS Joint Opinion 03/2022 on the Proposal for a Regulation on the European Health Data Space
- Opinion 10/2022 on the draft decision of the Hesse Supervisory Authority (Germany) regarding the Controller Binding Corporate Rules of Fresenius Group
- Opinion 02/2022 on the draft decision of the French Supervisory Authority regarding the Controller Binding Corporate Rules of the WEBHELP Group
- Recommendations 01/2020 on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data
- Guidelines 2/2020 on articles 46 (2) (a) and 46 (3) (b) of Regulation 2016/679 for transfers of personal data between EEA and non-EEA public authorities and bodies
- Opinion 24/2020 on the draft decision of the Norwegian Supervisory Authority regarding the Controller Binding Corporate Rules of Jotun
- Guidelines 03/2020 on the processing of data concerning health for the purpose of scientific research in the context of the COVID-19 outbreak
- Philippe Latombe v European Commission
- Thomas Bindl v European Commission
- European Commission v Republic of Poland
- European Commission v Republic of Poland
- WM and Sovim SA v Luxembourg Business Registers
- Proximus NV v Gegevensbeschermingsautoriteit
- European Commission v Republic of Poland
- European Commission v Republic of Poland
- Opinion 3/2026 on the draft decision of the Dutch Supervisory Authority regarding the Controller Binding Corporate Rules of the FrieslandCampina Group
- Opinion 2/2026 on the draft decision of the Dutch Supervisory Authority regarding the Controller Binding Corporate Rules of the AkzoNobel Group
- PROTECTION OF DATA SUBJECT RIGHTS IN THE TRANSFER OF PERSONAL DATA BETWEEN DATA CONTROLLERS IN INDONESIA: A COMPARATIVE ANALYSIS OF THE PDP LAW AND THE EU GDPR
- NAIH (Hungary) - NAIH-450-7-2026
- Austrian DSB: e-marketplace transfer of customer data to China and US requires valid Art.
- OVG Sachsen - 7 C 35/24
- Opinion 22/2026 on the draft decision of the Dutch Supervisory Authority regarding the Controller Binding Corporate Rules of the DSM Firmenich Group
- Opinion 23/2026 on the draft decision of the Norwegian Supervisory Authority regarding the Controller Binding Corporate Rules of the TGS Group