Adequacy is a term that the EU uses to describe other countries, territories, sectors or international

organisations that it deems to provide an ‘essentially equivalent’ level of data protection to that

which exists within the EU. An adequacy decision is a formal decision made by the EU which

recognises that another country, territory, sector or international organisation provides an equivalent

level of protection for personal data as the EU does. The effect of such a decision is that personal

data can flow from the EU (and Norway, Liechtenstein and Iceland) to that third country without any

further safeguard being necessary12.

The European Commission has so far recognised Andorra, Argentina, Canada (commercial

organisations), Faroe Islands, Guernsey, Israel, Isle of Man, Japan, Jersey, New Zealand, Republic of

Korea, Switzerland, the United Kingdom under the GDPR and the LED, the United States (commercial

organisations participating in the EU-US Data Privacy Framework) and Uruguay as providing

adequate protection13. On 28 June 2021, the EU Commission published two adequacy decisions in

respect of the UK: one for transfers under the EU GDPR; and the other for transfers under the Law

Enforcement Directive (LED)2. These decisions contain the European Commission’s detailed

assessment of the UK’s laws and systems for protecting personal data, as well as the legislation

designating the UK as adequate. Both adequacy decisions are expected to last until 27 June 20252.

Among the four options given, only Switzerland has been granted an adequacy decision by the EU,

which means that it will continue to enjoy adequacy status under the GDPR, pending any future

European Commission decision to the contrary. Greece is a member state of the EU, so it does not

need an adequacy decision to receive personal data from the EU. Norway is a member of the

European Economic Area (EEA), which also includes Iceland and Liechtenstein, and has incorporated

the GDPR into its national law, so it also does not need an adequacy decision. Australia has not been

recognised as adequate by the EU, so transfers of personal data from the EU to Australia require

appropriate safeguards or derogations13. Therefore, the correct answer is D. Switzerland. Reference:

https://pages.iapp.org/Free-Study-Guides_CIPPE-PPC-EU.html https://data-privacyoffice.eu/courses/cipp-e-official-training-course/

Reference: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-dataprotection/ adequacy-decisions_en