The first thing to consider when transferring personal data to a third country is if there is an "adequacy decision". An adequacy decision means that the European Commission has decided that a third country or an international organization ensures an adequate level of data protection.