International Data Transfers

The legal framework

Chapter V GDPR (Articles 44 to 50) prohibits transfers of personal data outside the European Economic Area unless one of the following bases applies. A transfer includes remote access from a third country, not only sending files.

1. Adequacy decision (Article 45). The Commission has decided that the country, territory or sector ensures an adequate level of protection. Examples include Switzerland, Japan and, for certified organisations, the United States under the Data Privacy Framework. No further authorisation is needed.
2. Appropriate safeguards (Article 46). The most used are the standard contractual clauses (SCCs) adopted by the Commission in Implementing Decision (EU) 2021/914, and binding corporate rules (Article 47) for groups.
3. Derogations (Article 49). Limited cases such as explicit consent to a specific transfer or necessity for a contract with the individual. They are interpreted restrictively and are not meant for routine transfers.

Schrems II

In Case C-311/18 (Schrems II, 16 July 2020) the Court of Justice invalidated the Privacy Shield and held that SCCs remain valid but that the exporter, with the importer, must verify whether the law of the destination country allows the importer to comply with them. If not, supplementary measures are needed, or the transfer must be stopped. The European Data Protection Board published recommendations on this assessment. Practice calls it a transfer impact assessment.

The EU-US Data Privacy Framework

The Commission adopted an adequacy decision for the United States on 10 July 2023. It covers transfers to US organisations that have self-certified under the framework and appear on the Data Privacy Framework list. The decision rests on Executive Order 14086 and on the Data Protection Review Court as a redress mechanism.

Its status as of October 2026: on 3 September 2025 the General Court dismissed a challenge by a French member of parliament, Philippe Latombe (Case T-553/23), and upheld the decision. An appeal to the Court of Justice (Case C-703/25 P) was filed in autumn 2025 and, to our knowledge, has not yet been decided. The decision therefore remains valid and can be relied upon, but the risk that the Court of Justice reviews it again is real. Exporters who depend heavily on the framework should keep SCCs as a fallback in their contracts and monitor the case.

Practical rules

• The exporter remains responsible. A transfer clause in a vendor contract does not move the duty.
• Onward transfers must be covered by the same level of protection.
• The transfer basis and country belong in your record of processing and in your processing agreement.
• Privacy notices must mention transfers and the safeguard.

In practice

A marketing agency uses a US email platform. The platform is certified under the Data Privacy Framework, so the agency can transfer on the basis of the adequacy decision. The agency also keeps the platform's SCCs in the agreement as a fallback and notes the transfer in the register. A second tool, a customer-support chat hosted by a company in India, is not covered by an adequacy decision. The agency signs SCCs (module two: controller to processor), assesses the Indian legal framework for government access to data, adopts encryption in transit and at rest with keys held in the EU where possible and records the outcome. When the assessment shows an unresolved risk for certain data, the agency decides not to send those fields to the tool.

Access from a third country counts too: a developer in a non-EEA subsidiary who can view the production database creates a transfer to which Chapter V applies.

Frequently asked questions

Is it safe to rely on the Data Privacy Framework?

It is valid at the time of writing, as the General Court has upheld it. Because an appeal is pending, keep a fallback and review your position when the Court of Justice rules.

Do SCCs alone make a transfer lawful?

Only together with the assessment of the destination country's law and, where needed, supplementary measures.

What about cloud providers with EU data centres?

If the provider or its affiliates can be compelled to give access from a third country, or staff abroad can access the data, a transfer analysis is still needed.

Do we have to inform individuals about transfers?

Yes. Articles 13(1)(f) and 14(1)(f) require you to mention the transfer and the safeguard used.

How this connects

Transfer clauses are a core part of data processing agreements and of data licensing and sharing arrangements. Drafting is supported by our Document Studio, and the transfer position of each supplier is kept in the privacy register.