International data transfer

An international data transfer takes place when personal data within the scope of the GDPR is transferred to a recipient in a country outside the European Economic Area or to an international organisation. It can also include a subsequent transfer from the first third country to another third country. The relevant point is that the data is made available to a controller, processor or other recipient outside the protection framework of EU data protection law.

Before making a transfer, organisations must check the requirements of Chapter V GDPR. An adequacy decision by the European Commission under Article 45 GDPR may provide the basis for the transfer. If there is no adequacy decision, appropriate safeguards under Article 46 GDPR may be used, including standard contractual clauses. Enforceable rights and effective legal remedies must also be available. The derogations in Article 49 GDPR are designed for specific situations and do not replace an ongoing transfer arrangement.

In practice, controllers should document the data flow, the recipients involved, the destination country, possible onward transfers and the transfer instrument used. Where appropriate safeguards are relied on, the law and actual access conditions in the destination country may require additional measures. A Transfer Impact Assessment supports this review, but it does not replace a lawful basis for the underlying processing or the other requirements of the GDPR.