The European Commission can decide whether a country outside Europe (or an international organisation) offers an ‘adequate’ level of data protection, which facilitates the data flows between Europe and this country. 

The EDPB is in charge of issuing opinions on the draft adequacy decisions, before the decision of the European Commission. The opinions are not binding on the European Commission but are usually useful for the other organisations which are consulted in this framework, such as the EU Member States.

Further, the European Commission is the one competent to monitor developments in non-European countries that could affect adequacy decisions. Some adequacy decisions provide for a specific regularity for the review of the decision and may refer to the possibility for EDPB representatives to take part in the review process organised by the European Commission.

Please also note that European Data Protection Authorities may protect individuals with respect with data transfers made within the context of adequacy decision (please find a list of them on our website: https://edpb.europa.eu/about-edpb/board/members_en).

If you believe that an existing adequacy decision is not in line with your fundamental rights of the individual to privacy and data protection, you may initiate a complaint to your DPA which may bring those objections before a national court which may be required to make a reference for a preliminary ruling to the Court of Justice (See Article 58(5) GDPR and ECJ Schrems judgment (Case C-362/14)).

For additional information, please see: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en