DAILY

Third-country transfer

Available Data protection

Personal data may be transferred to a country outside the EEA only in compliance with Chapter V GDPR: an adequacy decision, appropriate safeguards with an assessment of the destination country, or exceptionally a derogation under Art. 49. The assessment follows this order and EDPB Recommendations 01/2020 on the Schrems II judgment. It does not replace the legal basis under Art. 6 and the processing agreement, which are needed in addition.

Is there a transfer?

1. Is personal data transferred or made accessible to a recipient outside the EEA, including through remote access, support or a cloud service?

An EU data centre of a provider whose parent company is in a third country can also be relevant because of access rights there.

EDPB Leitlinien 05/2021

Adequacy

2. Is there a Commission adequacy decision for the destination country that covers this recipient (e.g. Switzerland, United Kingdom, Japan, Republic of Korea, Israel, New Zealand, Argentina, Uruguay, Canada for commercial organisations)?

The Commission publishes the current list; decisions may be time-limited or restricted to certain sectors.

Art. 45 DSGVO Open in the law texts
3. For recipients in the USA: is the recipient actively certified under the EU-U.S. Data Privacy Framework, and does the certification cover the data transferred (e.g. HR data)?
Art. 45, Durchführungsbeschluss (EU) 2023/1795 DSGVO Open in the law texts

Appropriate safeguards

4. Have the Commission's standard contractual clauses (Implementing Decision 2021/914) been concluded in the appropriate module?
Art. 46 Abs. 2 lit. c DSGVO Open in the law texts
5. Or are there approved binding corporate rules that cover the recipient?
Art. 47 DSGVO Open in the law texts
6. Has a transfer impact assessment been carried out that evaluates law and practice of the destination country, in particular access by public authorities?
EDPB Empfehlungen 01/2020, Schritt 3
7. If the assessment reveals gaps: are effective supplementary measures in place, such as encryption with keys held only in the EEA, or pseudonymisation?
EDPB Empfehlungen 01/2020, Schritt 4

Derogations

8. For an occasional, non-repetitive transfer, does a derogation under Art. 49 apply, such as explicit consent after being informed of the risks, the performance of a contract with the data subject, or legal claims?
Art. 49 Abs. 1 DSGVO Open in the law texts
This result is not saved. With an account, assessments are stored with date and catalog version.
Menu
Preview · What this means
Dark paper