As of November 2026, the European Commission's adequacy page recognizes 17 entries as providing an adequate level of data protection under Article 45 of the GDPR: 16 countries and territories plus the European Patent Organization. The newest additions are Brazil in January 2026 and the Patent Organization in July 2025, while the UK decisions were renewed in December 2025.
Which countries are on the EU adequacy list in 2026?
The Commission's adequacy page names Andorra, Argentina, Brazil, Canada (commercial organizations), the Faroe Islands, Guernsey, Israel, the Isle of Man, Japan, Jersey, New Zealand, the Republic of Korea, Switzerland, the United Kingdom, the United States (commercial organizations participating in the EU-US Data Privacy Framework), Uruguay and the European Patent Organization. That is 17 entries by our count of the Commission's list.
The effect, in the Commission's words, is that personal data "can flow from the EU (and Norway, Liechtenstein and Iceland)" to that destination "without any further safeguard being necessary." Transfers are treated like transmissions inside the EU.
The list is short compared with the number of national privacy laws. Our global privacy laws tracker shows how many countries have passed a data protection law, and most of them do not hold an adequacy decision. Countries such as India, Australia and China do not appear on the Commission's list as of November 2026.
Seventeen entries is the whole list, and two of them carry limits on who is covered.
When was each adequacy decision adopted?
Eleven of the 17 decisions were adopted under the old Directive 95/46/EC. The Commission published a report on the first review of "the eleven adequacy decisions adopted pursuant to Directive 95/46/EC" on 15 January 2024. Their adoption years, taken from the decision dates in the Commission's report, run from Switzerland in 2000 to New Zealand in 2012.
Figure 2: Adequacy decisions on the Commission's list by adoption window, counted from each decision's adoption date as given in the Commission's reports and adequacy page. Source: European Commission, Adequacy decisions page (November 2026).
| Entry | Adopted | Scope or note |
|---|---|---|
| Switzerland | 2000 | Pre-GDPR decision |
| Canada | 2001 | Commercial organizations only |
| Argentina, Guernsey | 2003 | Pre-GDPR decisions |
| Isle of Man | 2004 | Pre-GDPR decision |
| Jersey | 2008 | Pre-GDPR decision |
| Faroe Islands, Andorra | 2010 | Pre-GDPR decisions |
| Israel | 2011 | Pre-GDPR decision |
| Uruguay, New Zealand | 2012 | Pre-GDPR decisions |
| Japan | 2019 | First review report 4 April 2023 |
| United Kingdom | 28 June 2021 | Renewed 19 December 2025, GDPR and LED |
| Republic of Korea | 17 December 2021 | First review concluded 23 July 2026 |
| United States | 10 July 2023 | Data Privacy Framework participants only |
| European Patent Organization | 15 July 2025 | First for an international organization |
| Brazil | 26 January 2026 | Mutual decisions with Brazil's ANPD |
Only 6 of the 17 entries have been added since 2019, so the list has grown by roughly one decision a year since then. Eleven of the 17 are older than the GDPR itself.
What changed with Brazil, the UK and Korea?
Three decisions changed in the last 12 months. Brazil was added, the UK was renewed, and Korea passed its first review.
On 27 January 2026 the Commission announced that it "and Brazil adopted mutual adequacy decisions, confirming that their levels of data protection are comparable." The Commission decision itself is dated 26 January 2026 (C(2026) 373 final) and concerns Brazil's LGPD framework. For how Brazil's regulator is using that law, see our Brazil LGPD enforcement data.
On 19 December 2025 the Commission renewed the two 2021 UK decisions, one under the GDPR and one under the Law Enforcement Directive. The 2021 decision had been set to expire on 27 June 2025 and was first extended to 27 December 2025. The Commission's adequacy page says the UK is the only entry whose decision also covers law enforcement data. Our comparison of UK GDPR and EU GDPR divergence covers what the UK changed in its law.
On 23 July 2026 the Commission "concluded today its first review of the 2021 adequacy decision for the Republic of Korea" and found that Korea "continues to provide an adequate level of protection." Its report adds recommendations on onward transfers and enforcement. Korea's enforcement activity is tracked in our South Korea PIPA enforcement data.
One new decision, one renewal and one clean review in a single year shows the list is actively maintained, not frozen.
How does the Commission adopt an adequacy decision?
The Commission's adequacy page describes four steps: a proposal from the Commission, an opinion of the European Data Protection Board, an approval from representatives of EU countries, and adoption by the Commission. At any time, the European Parliament and the Council may ask the Commission to maintain, amend or withdraw a decision.
Figure 3: The adoption and review path for a GDPR adequacy decision. Source: European Commission, Adequacy decisions page; Article 3 of the Brazil and European Patent Organization decisions.
The EDPB step is visible in practice. The UK renewal decision cites EDPB Opinion 26/2025 and the European Patent Organization decision followed EDPB Opinion 07/2025. The procedure has four steps, and the Commission keeps the power to suspend, amend or repeal a decision after adoption.
How long does an adequacy decision last?
A decision lasts until the Commission or the Court of Justice ends it, but the Commission must review each one. The Brazil decision says that "after four years from the date of the notification of this Decision to the Member States and subsequently at least every four years, the Commission shall evaluate" the finding. The European Patent Organization decision uses the same "at least every four years" cycle. The renewed UK decision adds a hard end date, 27 December 2031.
Figure 4: Review intervals and term lengths in years. UK renewed term is the six-year application period; the four-year figures are minimum review cycles in the Brazil and European Patent Organization decisions and the UK decision's review recital; the US figure is the Commission's stated view on the next review. Source: Commission Implementing Decisions C(2025) 8771, C(2026) 373 and C(2025) 4626; Commission report on the first periodic review of the Data Privacy Framework (9 October 2024).
The US entry has its own rhythm. The Commission's first periodic review report, published on 9 October 2024, noted that more than 2,800 companies had become Data Privacy Framework certified, compared with 2,400 under the Privacy Shield in the same period of its operation. The report says the Commission "considers it appropriate to carry out the next periodic review after three years." We cover the legal risk around that framework in our piece on the EU-US Data Privacy Framework.
Review cycles run from 3 to 6 years, so a listed destination can lose its status when the Commission or the Court acts.
What does the list mean for your website?
If your business sends EU personal data to a listed destination, Chapter V of the GDPR does not require an additional transfer mechanism for that transfer, for entries covering your recipient. For Canada the entry covers commercial organizations, and for the US it covers only recipients certified under the Data Privacy Framework. A US vendor that is not certified is not covered by that entry.
For everything else, GDPR Chapter V points to other tools, such as the Article 46 safeguards, and the Commission's list does not change those. This post gives information, not legal advice, so ask counsel about a particular transfer. The practical step for a site owner is to record where each processor sits and which basis applies, then describe those transfers in a privacy policy that names the countries involved.
Check the entry's scope before relying on it.
The Bottom Line
The Commission recognizes 17 adequacy decisions as of November 2026: 16 countries and territories plus the European Patent Organization. Eleven are from the Directive 95/46/EC era, and the six added since 2019 include Brazil in January 2026 and the Patent Organization in July 2025. The UK decision now runs to 27 December 2031, Korea has passed its first review, and the Commission considers the next US framework review appropriate three years after the October 2024 report.
For a site owner the useful takeaway is narrow. A destination on the list can lawfully receive EU personal data without an extra Chapter V mechanism, but only within the scope of its entry, and the list can change. Keep a record of each processor's location, check it against the Commission's page before each policy update, and use another transfer tool where the destination is not covered. Re-check the page whenever you add a vendor in a new country.
Frequently Asked Questions
How many countries have an EU adequacy decision in 2026? The European Commission's adequacy page lists 17 recognized entries as of November 2026: 16 countries and territories plus the European Patent Organization, its first adequacy decision for an international organization. Canada and the United States are recognized for commercial organizations only, and the United States only for those participating in the EU-US Data Privacy Framework.
Which countries got new adequacy decisions in 2025 and 2026? Brazil received an adequacy decision on 26 January 2026, announced on 27 January as a mutual arrangement with Brazil's own decision. The European Patent Organization was recognized on 15 July 2025, and the UK decisions were renewed on 19 December 2025 until 27 December 2031.
Do adequacy decisions expire or get reviewed? Yes. The Commission must review them periodically. The Brazil and European Patent Organization decisions provide for evaluation at least every 4 years, the renewed UK decision runs for 6 years, and the Commission considers it appropriate to hold the next review of the US Data Privacy Framework after 3 years.
What if a country is not on the adequacy list? Transfers to a country without an adequacy decision need another Chapter V mechanism, such as the Article 46 safeguards or a listed Article 49 derogation. The Commission's list has 17 entries, so most countries in the world are not on it.
Where the Numbers Come From
- European Commission: Adequacy decisions. The list of 17 entries, procedure, dates, Korea review (23 July 2026), 15 January 2024 and 9 October 2024 review reports.
- European Commission: Implementing Decision on the adequate level of protection of personal data by Brazil, C(2026) 373 final (26 January 2026). Adoption date and Article 3(4) four-year evaluation.
- European Commission: Implementing Decision amending Decision (EU) 2021/1772 on the UK, C(2025) 8771 final (19 December 2025). Expiry on 27 December 2031, six-year term, EDPB Opinion 26/2025.
- European Commission: Technical extension of the UK adequacy decision under the GDPR (24 June 2025). Extension to 27 December 2025.
- European Commission: Implementing Decision on the adequate protection of personal data by the European Patent Organization, C(2025) 4626 final (15 July 2025). Adoption date and Article 3(3) four-year evaluation.
- European Commission: Joint statement by Michael McGrath and António Campinos (15 July 2025). First adequacy decision relating to an international organization.
- European Commission: Commission finds that Republic of Korea continues to provide an adequate level of protection (23 July 2026). First review of the 2021 decision.
- European Commission: Report on the first periodic review of the functioning of the adequacy decision on the EU-US Data Privacy Framework (9 October 2024). More than 2,800 certified companies, 2,400 Privacy Shield comparison, next review after three years.
- European Commission: Report on the first review of the functioning of the adequacy decisions adopted pursuant to Article 25(6) of Directive 95/46/EC (15 January 2024). Adoption dates of the eleven pre-GDPR decisions.
Note: All figures verified as of November 2026 against the Commission's adequacy page and decision texts. The list changes when the Commission adopts, renews or repeals a decision, and the Data Privacy Framework is due another review.
