International Data Transfers
What instruments are available for transferring personal data to third countries outside the EEA — from adequacy decisions and standard contractual clauses to the derogations under Article 49 GDPR.
The transfer of personal data to countries outside the European Economic Area (EEA) is permitted only under specific conditions. Chapter V of the GDPR (Articles 44–49) establishes a tiered system of transfer mechanisms designed to ensure that the level of protection guaranteed by the GDPR is not undermined by third-country transfers.
Adequacy Decisions
The first and simplest basis is an adequacy decision of the European Commission under Article 45 GDPR. Where such a decision is in place, data may be transferred without further authorisation. Currently recognised countries include Switzerland, Japan, New Zealand, the United Kingdom, and — following the Schrems II judgment and the EU-US Data Privacy Framework (DPF) of 2023 — certified US organisations.
Appropriate Safeguards
Where no adequacy decision exists, appropriate safeguards under Article 46 GDPR are required. The most important transfer mechanism is the Standard Contractual Clauses (SCCs) adopted by the Commission, updated in 2021. The SCCs must be incorporated unchanged; supplementary clauses may be added provided they do not contradict the SCCs. Other available instruments include Binding Corporate Rules (BCRs) for intra-group transfers and approved codes of conduct or certification mechanisms.
Following the Schrems II judgment of the CJEU (C-311/18), controllers are additionally required to carry out a Transfer Impact Assessment (TIA) to verify that the transfer mechanism provides an equivalent level of protection in the destination country. For US transfers under the DPF, the certification of the US recipient must be verified via the official DPF list.
Derogations Under Article 49
Article 49 GDPR provides derogations that should be used only in exceptional circumstances. These include the data subject's explicit consent, the performance of a contract, important public interest grounds, and vital interests. Supervisory authorities emphasise that Article 49 derogations may not serve as a permanent basis for systematic transfers.