# Third-Country Adequacy Assessment Workflow

## Pre-Transfer Adequacy Verification

1. **Identify the destination country**: Determine the country where the data importer processes the data.
2. **Check the EC adequacy list**: Consult the European Commission's list of adequacy decisions at ec.europa.eu.
3. **If adequacy exists**: Verify the scope of the decision covers the specific recipient and sector.
4. **If no adequacy**: The transfer requires Art. 46 safeguards (SCCs, BCRs) or Art. 49 derogations.
5. **Document**: Record the adequacy status, decision reference, and scope verification in the transfer register.

## Partial Adequacy Verification Workflow

### Canada
1. Identify the Canadian recipient organisation.
2. Determine whether the recipient is subject to PIPEDA or a substantially similar provincial law.
3. If subject to PIPEDA: adequacy applies; document and proceed.
4. If not subject to PIPEDA (e.g., public sector, health sector): adequacy does not apply; establish SCCs.

### Japan
1. Identify the Japanese recipient organisation.
2. Confirm the recipient is a "business operator handling personal information" under APPI.
3. Confirm the recipient has implemented the PPC supplementary rules for EU data.
4. If confirmed: adequacy applies; document and proceed.
5. If not confirmed: request evidence of supplementary rule implementation; establish SCCs as fallback.

### United States
1. Identify the US recipient organisation.
2. Check dataprivacyframework.gov for active DPF certification.
3. Verify certification scope covers the relevant data categories (HR, non-HR, or both).
4. Verify FTC or DoT jurisdiction applies.
5. If DPF-certified and in scope: adequacy applies; document and proceed.
6. If not certified or not in scope: adequacy does not apply; establish SCCs with TIA.

## Adequacy Decision Monitoring Workflow

### Continuous Monitoring
1. Subscribe to EC and EDPB news feeds for adequacy-related announcements.
2. Track legislative developments in countries with adequacy decisions using legal monitoring services.
3. Monitor CJEU docket for any challenges to existing adequacy decisions.

### Scheduled Reviews
1. Maintain a calendar of adequacy decision review dates.
2. 90 days before a scheduled review: assess contingency readiness (backup SCCs).
3. Upon review completion: assess the Commission's findings and any conditions or concerns.
4. If the Commission suspends or repeals an adequacy decision: activate backup transfer mechanisms within the Commission's transition period.

### UK Adequacy Sunset Management
1. Monitor the Commission's assessment of UK adequacy renewal (due by June 2025).
2. Prepare backup SCCs (Module 1 or 2 as appropriate) for all UK transfers by March 2025.
3. If renewed: archive backup SCCs; update the transfer register.
4. If not renewed: activate SCCs for all UK transfers effective from the sunset date.
5. Communicate the change to all UK data importers and update contractual arrangements.

## New Adequacy Decision Assessment
When a new adequacy decision is adopted for a country where the organisation has existing SCCs:

1. Verify the adequacy decision scope covers the organisation's transfers.
2. If covered: update the transfer register mechanism from SCCs to adequacy.
3. Maintain SCCs as a dormant backup (no need to terminate).
4. Update Art. 30 records to reflect the new transfer basis.
5. Simplify compliance documentation (TIA no longer required for adequacy-based transfers).