Make your website GDPR compliant today — Cookiebot automates cookie consent, scanning, and compliance so you don't have to. Try Cookiebot Free

International Data Transfers

Rules and mechanisms for transferring personal data outside the European Economic Area to ensure adequate protection.

International Data Transfers under GDPR

Chapter V of the GDPR (Articles 44-50) governs the transfer of personal data to countries outside the European Economic Area (EEA). These rules ensure that the level of protection afforded by the GDPR is not undermined when data is transferred internationally.

General Principles

Personal data can only be transferred to a third country or international organization if the controller and processor comply with GDPR conditions, including:

  • All other GDPR provisions are met
  • One of the transfer mechanisms outlined in Chapter V is in place

Adequacy Decisions

Under Article 45, the European Commission can decide that a third country, territory, or international organization provides an adequate level of data protection. When such a decision exists, data can flow freely without additional safeguards. Countries with adequacy decisions include:

  • Andorra, Argentina, Canada (commercial organizations), Faroe Islands, Guernsey, Israel, Isle of Man, Japan, Jersey, New Zealand, South Korea, Switzerland, United Kingdom, and Uruguay

Appropriate Safeguards

In the absence of an adequacy decision, Article 46 allows transfers if appropriate safeguards are in place, such as:

  • Standard Contractual Clauses (SCCs): EU-approved model contracts
  • Binding Corporate Rules (BCRs): Internal rules adopted by multinational companies
  • Codes of conduct or certification mechanisms with binding commitments
  • Ad-hoc contractual clauses approved by supervisory authorities

Transfer Impact Assessments

Following the Schrems II decision, organizations must assess whether the law or practice of the destination country impinges on the effectiveness of safeguards. If necessary, supplementary measures must be implemented.

Derogations for Specific Situations

Article 49 provides limited derogations for specific situations where transfers may occur without adequacy or safeguards, including:

  • Explicit consent from the data subject
  • Necessary for contract performance
  • Important public interest reasons
  • Legal claims
  • Vital interests of the data subject

These derogations should be used only occasionally and when necessary.

Related Articles