The European Commission has the power to adopt findings that confirm the adequacy of the data protection level in a non-EU country. According to GDPR, the European Commission is responsible for determining whether a country outside the EU offers an adequate level of data protection by issuing adequacy decisions.