Definition
Under Article 45 GDPR, the Commission can recognise countries as adequate. The list includes Switzerland, the United Kingdom, Japan, Canada (for commercial organisations), Israel and others, and covers the US for companies certified under the EU-US Data Privacy Framework.
How it works
With an adequacy decision, EU companies can send personal data to that country without extra safeguards such as standard contractual clauses. Decisions are reviewed and can be struck down by the Court of Justice, as happened with Safe Harbor in 2015 and Privacy Shield in 2020.
Why it matters
When a VPN provider is based outside the EU, adequacy is one signal of how its home country treats personal data. Switzerland's adequacy status is one reason Swiss-based services are popular with European users.