The meaning of „adequate” under GDPR – lesson learnt from EU bodies

Abstract

The concept of “adequate” data protection model in third country or organisation plays vital role in General Data Protection Regulation, but more importantly – in business and relations between European Union and other international actors. Understanding what “adequate” means is crucial for ensuring the security of personal data transferred outside EU. However, the European Union has not provided clear guidance on this matter, which may have negative consequences for businesses, individuals, and the EU as a whole. This paper examines the meaning of 'adequate' by analyzing the work of EU institutions through a deep-dive investigation, as well as comparative and conceptual legal research. The outcome of the research allow researchers and professionals to deeply understand adequacy requirements under General Data Protection Regulation and is viable source for further research in the area but also – in the practice of ensuring GDPR compliance by both private and public organisations.