In this contribution the EU’s policy on data exchange in criminal matters to third states or institutions is first studied from the perspective before and after the framework decision on data protection in criminal matters. Secondly, the provisions of the framework decision that regulate the outgoing data transfer – including the effects on existing and future provisions – are examined. In a third and final part, the future of the adequacy requirement in agreements with third states and as included in the policy plans of the EU is reflected on.