International transfers

The rule

Chapter V of the GDPR allows transfers outside the European Economic Area only where the level of protection is not undermined. A transfer includes remote access from a third country, not just copying files abroad. The DPO should know where data goes, including through cloud and AI suppliers and their sub-processors.

Transfer tools

• Adequacy decisions (Article 45): the Commission has found that a country or framework ensures adequate protection — for example the EU-US Data Privacy Framework for certified US organisations (2023).
• Appropriate safeguards (Article 46): most often the Commission’s standard contractual clauses (2021), with a transfer impact assessment of the destination’s laws and practices and supplementary measures where needed.
• Binding corporate rules (Article 47) for transfers within a corporate group, approved by a supervisory authority.
• Derogations (Article 49), such as explicit consent or necessity for a contract, for specific situations — not regular, large-scale transfers.

In practice

Map transfers in the records of processing, check each supplier’s sub-processor list and hosting locations, record the transfer tool relied on, and review it when laws or suppliers change. Check data-residency promises against support access and telemetry, which often involve transfers too.