Third-country transfer
- Art. 44–49 DSGVO Open in the law texts
- EuGH C-311/18 (Schrems II)
Is the transfer outside the EEA lawful? Checked in the order of Chapter V: adequacy decision and Data Privacy Framework, standard contractual clauses or BCRs with transfer impact assessment and supplementary measures, Art. 49 derogations.
Personal data may be transferred to a country outside the EEA only in compliance with Chapter V GDPR: an adequacy decision, appropriate safeguards with an assessment of the destination country, or exceptionally a derogation under Art. 49. The assessment follows this order and EDPB Recommendations 01/2020 on the Schrems II judgment. It does not replace the legal basis under Art. 6 and the processing agreement, which are needed in addition.