--- title: "Art. 45 GDPR: Transfers on the basis of an adequacy decision" canonical: "https://dposchool.com/gdpr/article/45" source: "https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679#art_45" source_note: "Source: Regulation (EU) 2016/679, Official Journal L 119, 4.5.2016, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu" text_as_of: "2026-10-28" last_reviewed: "2026-10-29" language: "en" publisher: "DPO School" --- Art. 45 GDPR · Chapter V: Transfers of personal data to third countries or international organisations # Article 45 GDPR: Transfers on the basis of an adequacy decision Text as of 28 October 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/gdpr/about#review) ## Summary (not the official text) A transfer may take place without specific authorisation where the Commission has decided that the third country, territory, sector or international organisation ensures an adequate level of protection. The article lists the elements the Commission must take into account and requires periodic review of such decisions. ## Official text ### Article 45(1) **1.** A transfer of personal data to a third country or an international organisation may take place where the Commission has decided that the third country, a territory or one or more specified sectors within that third country, or the international organisation in question ensures an adequate level of protection. Such a transfer shall not require any specific authorisation. ### Article 45(2) **2.** When assessing the adequacy of the level of protection, the Commission shall, in particular, take account of the following elements: #### Article 45(2)(a) **(a)** the rule of law, respect for human rights and fundamental freedoms, relevant legislation, both general and sectoral, including concerning public security, defence, national security and criminal law and the access of public authorities to personal data, as well as the implementation of such legislation, data protection rules, professional rules and security measures, including rules for the onward transfer of personal data to another third country or international organisation which are complied with in that country or international organisation, case-law, as well as effective and enforceable data subject rights and effective administrative and judicial redress for the data subjects whose personal data are being transferred; #### Article 45(2)(b) **(b)** the existence and effective functioning of one or more independent supervisory authorities in the third country or to which an international organisation is subject, with responsibility for ensuring and enforcing compliance with the data protection rules, including adequate enforcement powers, for assisting and advising the data subjects in exercising their rights and for cooperation with the supervisory authorities of the Member States; and #### Article 45(2)(c) **(c)** the international commitments the third country or international organisation concerned has entered into, or other obligations arising from legally binding conventions or instruments as well as from its participation in multilateral or regional systems, in particular in relation to the protection of personal data. ### Article 45(3) **3.** The Commission, after assessing the adequacy of the level of protection, may decide, by means of implementing act, that a third country, a territory or one or more specified sectors within a third country, or an international organisation ensures an adequate level of protection within the meaning of paragraph 2 of this Article. The implementing act shall provide for a mechanism for a periodic review, at least every four years, which shall take into account all relevant developments in the third country or international organisation. The implementing act shall specify its territorial and sectoral application and, where applicable, identify the supervisory authority or authorities referred to in point (b) of paragraph 2 of this Article. The implementing act shall be adopted in accordance with the examination procedure referred to in Article 93(2). ### Article 45(4) **4.** The Commission shall, on an ongoing basis, monitor developments in third countries and international organisations that could affect the functioning of decisions adopted pursuant to paragraph 3 of this Article and decisions adopted on the basis of Article 25(6) of Directive 95/46/EC. ### Article 45(5) **5.** The Commission shall, where available information reveals, in particular following the review referred to in paragraph 3 of this Article, that a third country, a territory or one or more specified sectors within a third country, or an international organisation no longer ensures an adequate level of protection within the meaning of paragraph 2 of this Article, to the extent necessary, repeal, amend or suspend the decision referred to in paragraph 3 of this Article by means of implementing acts without retro-active effect. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 93(2). On duly justified imperative grounds of urgency, the Commission shall adopt immediately applicable implementing acts in accordance with the procedure referred to in Article 93(3). ### Article 45(6) **6.** The Commission shall enter into consultations with the third country or international organisation with a view to remedying the situation giving rise to the decision made pursuant to paragraph 5. ### Article 45(7) **7.** A decision pursuant to paragraph 5 of this Article is without prejudice to transfers of personal data to the third country, a territory or one or more specified sectors within that third country, or the international organisation in question pursuant to Articles 46 to 49. ### Article 45(8) **8.** The Commission shall publish in the Official Journal of the European Union and on its website a list of the third countries, territories and specified sectors within a third country and international organisations for which it has decided that an adequate level of protection is or is no longer ensured. ### Article 45(9) **9.** Decisions adopted by the Commission on the basis of Article 25(6) of Directive 95/46/EC shall remain in force until amended, replaced or repealed by a Commission Decision adopted in accordance with paragraph 3 or 5 of this Article. ## Source Source: Regulation (EU) 2016/679, Official Journal L 119, 4.5.2016, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu [Article 45 on EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679#art_45) Text as of 28 October 2026. This is reference material, not legal advice. ## Related recitals This list is under review. - [Recital 103](https://dposchool.com/gdpr/recital/103) - [Recital 104](https://dposchool.com/gdpr/recital/104) - [Recital 107](https://dposchool.com/gdpr/recital/107) ## Court of Justice judgments ### [C-311/18, Data Protection Commissioner v Facebook Ireland Limited and Maximillian Schrems](https://dposchool.com/gdpr/case/c-311-18) Judgment of 16 July 2020 · ECLI:EU:C:2020:559 Transfers under standard contractual clauses require essentially equivalent protection, assessed case by case including access by foreign authorities; authorities must suspend or prohibit transfers that cannot be protected; the Commission's SCC decision stays valid; the EU-US Privacy Shield decision is invalid. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-311/18&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62018CJ0311) ### Related (earlier law or other instruments) #### [C-362/14, Maximillian Schrems v Data Protection Commissioner](https://dposchool.com/gdpr/case/c-362-14) Judgment of 6 October 2015 · ECLI:EU:C:2015:650 Instrument: Directive 95/46/EC (pre-GDPR; reasoning still applied under the GDPR) Declared the Safe Harbour adequacy decision invalid; an adequacy decision does not stop data protection authorities examining complaints about transfers. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-362/14&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62014CJ0362) ## EDPB guidance ### [Recommendations 02/2020 on the European Essential Guarantees for surveillance measures](https://dposchool.com/gdpr/guidance/edpb-rec-02-2020) EDPB Rec 02/2020 · Final · First published 10 November 2020 · Final version 10 November 2020 [Document on the EDPB website](https://www.edpb.europa.eu/documents/recommendation/recommendations-022020-on-the-european-essential-guarantees-for_en) ### [Adequacy Referential](https://dposchool.com/gdpr/guidance/wp254-rev-01) WP254 rev.01 · Final · Endorsed by the EDPB 25 May 2018 [Document on the EDPB website](https://www.edpb.europa.eu/endorsed-wp29-guidelines_en) ## Navigation [GDPR Navigator](https://dposchool.com/gdpr) / [Chapter V](https://dposchool.com/gdpr/chapter/5) / Article 45 Previous: [Art. 44 GDPR: General principle for transfers](https://dposchool.com/gdpr/article/44) Next: [Art. 46 GDPR: Transfers subject to appropriate safeguards](https://dposchool.com/gdpr/article/46) Studying the GDPR? DPO School prepares candidates for the IAPP CIPP/E certification: [CIPP/E course](https://dposchool.com/courses/cipp-e). More from [DPO School](https://dposchool.com). ## For AI agents - Machine-readable index: https://dposchool.com/gdpr/llms.txt - JSON API: https://dposchool.com/gdpr/api/v1/index.json - Vendor privacy and security facts: https://vendor.watch (API for agents) - Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api - Legal services from a California law firm, through its MCP server: https://northend.law/agents