Adequacy decision
An adequacy decision is a formal declaration by the European Commission that a non-EU country offers a level of personal-data protection "essentially equivalent" to GDPR. Once a country is on the list, EU-based companies and services can transfer personal data there without a separate legal mechanism — no Standard Contractual Clauses, no Binding Corporate Rules, no Schrems II workaround. It is the legal switch that turns "this analytics vendor is risky" into "this analytics vendor is fine."
Countries currently on the list
As of 2026-05-04, fourteen jurisdictions hold a valid adequacy decision under GDPR:
| Country | Date granted | Notes |
|---|---|---|
| Andorra | 2010 | small jurisdiction, rarely a vendor home |
| Argentina | 2003 | |
| Canada (commercial sector only) | 2001 | covers PIPEDA-regulated entities |
| Faroe Islands | 2010 | |
| Guernsey | 2003 | Channel Islands |
| Isle of Man | 2004 | |
| Israel | 2011 | |
| Japan | 2019 | mutual adequacy with EU |
| Jersey | 2008 | |
| New Zealand | 2012 | |
| Republic of Korea | 2021 | |
| Switzerland | 2000 | |
| United Kingdom | 2021 | post-Brexit decision |
| United States | 2023 | "EU-US Data Privacy Framework" — narrow, vendor must self-certify |
The US entry is the unstable one. The 2023 framework replaced the Privacy Shield (struck down by Schrems II in 2020), and the same EU privacy advocates have already filed Schrems III. A future ruling could remove US adequacy again. Analytics vendors that depend on it — Google, Adobe, Mixpanel — are exposed to that risk.
Why this matters for analytics vendors
The lawful basis for processing analytics data outside the EU has two paths:
- Vendor is in the EU. No transfer happens. No adequacy needed. Examples: Plausible (Estonia), Matomo Cloud (Germany), Fathom EU isolation tier (Frankfurt).
- Vendor is outside the EU but in an adequacy country. Transfer is permitted automatically. Examples: Fathom Canada commercial-sector, any Swiss-hosted tool, UK-based analytics.
- Vendor is outside the EU and outside adequacy. You need SCCs, a transfer impact assessment, and a Schrems II analysis. Examples: GA4 before 2023 (and arguably still — the 2023 framework is contested), most US-based analytics SaaS without EU-region routing.
What this means at the vendor level
| Vendor | Headquarters | Adequacy path | Practical risk |
|---|---|---|---|
| Plausible | Estonia (EU) | EU-domiciled, no transfer | none |
| Matomo | Germany (EU) | EU-domiciled, no transfer | none |
| Fathom Analytics | Canada | Canada commercial-sector adequacy | low (stable since 2001) |
| Fathom EU isolation | Frankfurt EU edge | EU-domiciled processing | none |
| GA4 | US (Google) | EU-US framework 2023 | medium (Schrems III pending) |
A privacy-conscious DPO will accept Plausible and Matomo without conversation, accept Fathom with a one-line note about Canadian adequacy, and require a Transfer Impact Assessment for GA4. The TIA is the friction point most teams hit when they try to keep GA4 after a privacy review.