What it asks for. Without an adequacy decision, personal data may be transferred to a third country or international organisation only if the controller or processor provides appropriate safeguards and enforceable rights and effective legal remedies are available to individuals. Safeguards include standard data protection clauses adopted by the Commission, binding corporate rules, approved codes of conduct or certification mechanisms with binding commitments, and some arrangements requiring authority authorisation.
In practice. Organisations put the current standard contractual clauses in place for relevant transfers, choosing the correct module, and assess whether the law and practice of the destination country allow the safeguards to work. Supplementary measures, such as encryption with keys held in the EEA, are added where needed. Evidence includes signed clauses, transfer impact assessments and a transfer register.
Common gaps. Clauses are signed but the assessment of the destination country is missing. Older contracts may still rely on outdated clauses.