Any transfer of personal data which are undergoing processing or are intended for processing after transfer to a third country or to an international organisation shall take place only if, subject to the other provisions of this Regulation, the conditions laid down in this Chapter are complied with by the controller and processor, including for onward transfers of personal data from the third country or an international organisation to another third country or to another international organisation. All provisions in this Chapter shall be applied in order to ensure that the level of protection of natural persons guaranteed by this Regulation is not undermined.
Article 44
General principle for transfers
Understanding This Article
Article 44 is the cornerstone of GDPR's international data transfer rules, establishing the fundamental principle that personal data leaving the EU must continue to be protected at a level essentially equivalent to that provided within the EU. This prevents organizations from circumventing GDPR protections by simply moving data outside the EU.
The article applies to all transfers to third countries (countries outside the EU/EEA) or international organizations, regardless of how the transfer occurs—whether it's a one-time transfer, continuous data flows, remote access, or cloud storage. Importantly, it also covers "onward transfers," meaning if data is transferred from the EU to Country A, and then Country A transfers it to Country B, the GDPR's protections must still apply.
Both controllers and processors are subject to these requirements. This means that if a processor transfers data internationally, they must ensure the transfer mechanism complies with Chapter V, not just rely on the controller's authorization.
The phrase "level of protection...shall not be undermined" is critical. It means transfers are not just about legal formalities—the destination must provide essentially equivalent protection. This principle was reinforced by the Court of Justice of the EU in the Schrems II decision, which invalidated the Privacy Shield framework because US surveillance practices undermined EU data protection standards.
Key Points
- All international transfers must comply with Chapter V conditions
- Applies to both controllers and processors
- Covers onward transfers from one third country to another
- Protection level guaranteed by GDPR must not be undermined
- Foundation principle for all international data transfer rules
Practical Application
Example 1 - Cloud Storage Transfer: A German healthcare company uses a US cloud provider to store patient data. Under Article 44, simply signing a contract is not enough—the company must ensure one of the transfer mechanisms in Chapter V applies (adequacy decision, Standard Contractual Clauses, Binding Corporate Rules, etc.) and that the protection level in the US destination is essentially equivalent to GDPR. Given US government surveillance concerns highlighted in Schrems II, the company may need additional safeguards like encryption where the US provider doesn't hold the keys.
Example 2 - Onward Transfer Scenario: A French retailer transfers customer data to its subsidiary in India using Standard Contractual Clauses. The Indian subsidiary then wants to use a Philippines-based call center for customer service. The onward transfer from India to Philippines must also comply with Chapter V—it cannot be a "back door" to circumvent GDPR protections. The Indian subsidiary must ensure appropriate transfer mechanisms and protections are in place for the Philippines transfer.
Example 3 - Remote Access: A UK company (pre-Brexit, or under UK GDPR) allows its employees in Brazil to remotely access EU customer data for technical support. Even though the data remains physically on EU servers, the remote access constitutes a transfer to Brazil because Brazilian employees process data from Brazil. The company must ensure Chapter V compliance, such as by implementing SCCs with its Brazilian entity and ensuring adequate technical safeguards.
Example 4 - International Organization: A European research institution wants to share health study data with the World Health Organization (WHO). Even though WHO is an international organization with important public health missions, the transfer must comply with Chapter V. The institution must ensure WHO provides appropriate safeguards for the data and respects data subject rights essentially equivalent to GDPR.