Answer: D - Data transfer mechanisms may include SCCs, BCRs, authorization from the competent Data Protection Agency, or adequacy decisions from an agency authorized to an adequate level of data protection.
With the invalidation of Safe Harbors and Privacy Shield, SCCs and BCRs are commonly-used mechanisms for cross-border data transfers. In cases of adequacy decisions, the EU Commission can provide a decision stating that a specific country ensures an adequate level of data protection. The EC has approved Adequacy decisions over time, and these are available on its public website.
The EU Commission has provided adequacy decisions for the following countries: Andorra, Argentina, Canada (commercial organizations), Faroe Island, Guernsey, Israel, Jersey, Isle of Man, New Zealand, Switzerland, Uruguay, and Japan.
