This can also apply to a certain territory, an international organisation or one or several sectors in a third country. In the General Data Protection Regulation this is called 'adequate level of protection'. The European Commission can decide that a third country ensures a sufficiently high level of protection and you may then transfer personal data there without any further safeguards being necessary. Guidelines 05/2021 on the Interplay between Article 3 and Chapter V of the GDPR How do we know if a third country has an adequate level of protection? When you store personal data in a cloud service that is based outside the EU/EEA.ĮDPB has adopted guidelines on the Interplay between Article 3 and Chapter V of the GDPR, including an interpretation of the notion of transfer to a third country.When you give someone outside the EU/EEA access, for example reading rights, to personal data stored within the EU/EEA.When you use a processor in a country outside the EU/EEA.When you send documents that contain personal data by e-mail to a receiver in a country outside the EU/EEA.

Publishing personal data on the Internet does not constitute a transfer to a third country if the website is stored with an Internet provider that is established in the EU.Įxamples of transferring personal data to a third country: Transfer of personal data to a third country is as a rule when personal data is sent of made available to a receiver outside the EU/EEA. Recommendations 01/2020 on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data What does 'transfer of data to a third country' mean? In cases where no such supplementary measures are suitable, you must avoid, suspend or terminate the transfer to avoid compromising the level of protection of the personal data.ĮDPB has adopted recommendations on supplementary measures. Or, whether supplementary measures need to be implemented, in order to ensure a level of protection that is essentially equivalent to that guaranteed within the EU. When relying on one of the transfer tools listed in Article 46 GDPR, such as SCC or BCR, it must be assessed whether the safeguards contained in the transfer tool can ensure, in practice, the effective protection of the transferred personal data.

Specific situations and single cases (derogations).

You have put in place appropriate safeguards, for example Binding Corporate Rules (BCR) or Standard Contractual Clauses (SCC).

There is a decision from the European Commission that, for example, a certain country outside the EU/EEA ensures an adequate level of protection.

It is permitted to transfer personal data to countries outside the EU/EEA under certain conditions: When are transfers outside the EU/EEA permitted? The General Data Protection Regulation therefore contains rules concerning under what conditions it is permitted to transfer personal data to countries outside the EU/EEA. Outside the EU/EEA, there are no general rules that provide equivalent protection. Personal data can thus be transmitted freely within this area without any restrictions. Under the General Data Protection Regulation all the member states of the European Union have equivalent protection of personal data. Why are special rules needed for transfers of personal data outside the EU/EEA?

Such transfer is only permitted under certain conditions. Do you process personal data that someone outside the EU has access to? Do you use service providers outside the EU? Do you store personal data in a cloud service? In the General Data Protection Regulation this is called 'transfer of personal data to a third country'.

Imy definition