International Data Transfers under the GDPR.
Transfers of personal data to a third country are regulated by Chapter V of the GDPR (Articles 44-50).
Article 44Article 44 of the GDPR provides the following:“Any transfer of personal data which are undergoing processing or are intended for processing after transfer to a third country or to an international organisation shall take place only if, subject to the other provisions of this Regulation, the conditions laid down in this Chapter are complied with by the controller and processor, including for onward transfers of personal data from the third country or an international organisation to another third country or to another international organisation. All provisions in this Chapter shall be applied in order to ensure that the level of protection of natural persons guaranteed by this Regulation is not undermined.”
Under Article 44, controllers and processors must first comply with all other applicable GDPR obligations before a transfer can take place. Transfers to a third country or an international organisation are permitted only where, in addition to the wider requirements of the GDPR, the specific transfer conditions in Chapter V are satisfied.
These “other provisions” refer to all relevant GDPR requirements. Depending on the context, they include:
Article 5 (data protection principles)
Article 6 (lawful basis for processing)
Data protection impact assessments (DPIAs), where required
Articles 13 and 14 (transparency obligations), including the transfer-related disclosures in Articles 13(1)(f) and 14(1)(f)
Article 15, including the access rights in Articles 15(1)(c) and 15(2)
Processor-related obligations, including transfer-relevant elements such as Article 28(3)(a)
Record-keeping obligations under Article 30, including Articles 30(1)(d)-(e) and 30(2)(c)
The key point is that Chapter V does not operate in isolation. Transfer rules apply alongside the rest of the GDPR and do not replace or reduce those general obligations.
What are the “conditions” in Chapter V?Chapter V contains three main routes for lawful transfers. Article 44 requires compliance with the relevant conditions, but not every provision in Chapter V applies in every case.
- Article 45: Transfers based on an adequacy decision: This route depends on the European Commission having adopted an adequacy decision for the destination country or international organisation.
- Articles 46-48: Transfers subject to appropriate safeguards: Where no adequacy decision exists, controllers and processors may rely on safeguards such as standard contractual clauses or other recognised mechanisms.
- Article 49: Derogations for specific situations: In limited cases, transfers may proceed on the basis of specific derogations.