§ GDPR · Article 45
GDPR Article 45: Obligations, Deadlines & Penalties
At a glance
Article 45 of the GDPR imposes 7 obligations on Commission.
§ Obligations
All obligations under Article 45
Obligation 1
The Commission shall take account of specific elements such as the rule of law, human rights, and data protection rules when assessing the adequacy of the level of protection in a third country or international organisation.
Regulation (EU) 2016/679, Article 45, Article 45
- Obligated entity
-
Commission
- Action required
-
assess
- Deadline
-
—
- Penalty
-
—
Obligation 2
The Commission may decide by means of implementing act that a third country, territory, or international organisation ensures an adequate level of protection, providing for a periodic review mechanism at least every four years.
Regulation (EU) 2016/679, Article 45, Article 45
- Obligated entity
-
Commission
- Action required
-
decide
- Deadline
-
—
- Penalty
-
—
Obligation 3
The Commission shall monitor developments in third countries and international organisations on an ongoing basis that could affect the functioning of adequacy decisions.
Regulation (EU) 2016/679, Article 45, Article 45
- Obligated entity
-
Commission
- Action required
-
monitor
- Deadline
-
—
- Penalty
-
—
Obligation 4
The Commission shall repeal, amend, or suspend an adequacy decision by means of implementing acts if information reveals that the third country or international organisation no longer ensures an adequate level of protection.
Regulation (EU) 2016/679, Article 45, Article 45
- Obligated entity
-
Commission
- Action required
-
repeal
- Deadline
-
—
- Penalty
-
—
Obligation 5
On duly justified imperative grounds of urgency, the Commission shall adopt immediately applicable implementing acts to repeal, amend, or suspend an adequacy decision.
Regulation (EU) 2016/679, Article 45, Article 45
- Obligated entity
-
Commission
- Action required
-
adopt
- Deadline
-
—
- Penalty
-
—
Obligation 6
The Commission shall enter into consultations with the third country or international organisation with a view to remedying the situation giving rise to the decision to repeal, amend, or suspend an adequacy decision.
Regulation (EU) 2016/679, Article 45, Article 45
- Obligated entity
-
Commission
- Action required
-
consult
- Deadline
-
—
- Penalty
-
—
Obligation 7
The Commission shall publish in the Official Journal of the European Union and on its website a list of third countries, territories, and international organisations for which it has decided that an adequate level of protection is or is no longer ensured.
Regulation (EU) 2016/679, Article 45, Article 45
- Obligated entity
-
Commission
- Action required
-
publish
- Deadline
-
—
- Penalty
-
—
§ Frequently asked
Questions about Article 45
Who must comply with Article 45 of the GDPR?
+
Commission.
What does Article 45 of the GDPR require?
+
assess decide monitor