International data transfer

What it means

An international data transfer means personal data leaving the European Economic Area, being provided or made available to a recipient outside the EU, Iceland, Liechtenstein and Norway. Remote access to data stored in the EU, for example by technical support in another country, also counts as a transfer. The rules are set out in Chapter V of the GDPR.

A transfer is allowed only if one of the legal mechanisms is met. The simplest is a European Commission adequacy decision finding that the country offers comparable protection. Without one, appropriate safeguards are used, most often standard contractual clauses, binding corporate rules or approved codes of conduct.

For the United States the EU-US Data Privacy Framework applies, but only to US companies certified under it. For uncertified recipients another mechanism is needed. The derogations under Article 49 GDPR, such as explicit consent or performance of a contract, are meant only for occasional transfers, not day-to-day operations.

How it works in practice

Companies often transfer data without realising it, through cloud services, email tools, CRM, analytics, customer support or file sharing. The first step is therefore to map where suppliers and their sub-processors are located, where data is physically stored and from where it is accessed. The result belongs in the record of processing activities.

When using standard clauses, a transfer impact assessment must be carried out, evaluating the law of the destination country, especially public authority access to data, and adding technical measures where needed, such as encryption with keys held in the EU. The clauses usually become part of the data processing agreement with the supplier.

Large providers have transfer documentation ready and often offer EU data storage. With smaller suppliers, such as developers or call centres outside the EU, the clauses have to be prepared and signed individually. Information about the transfer must also appear in the privacy notice for data subjects.

What to watch out for

The most common mistake is relying on the supplier being European. If its servers or support are outside the EEA, a transfer still takes place. Using free tools without a contract, where the company does not know where data is processed, is just as risky. The Data Protection Authority can impose a fine for an unlawful transfer.

The legal framework changes. Adequacy decisions can be struck down by the EU Court of Justice, as happened with earlier frameworks for the US. A company should therefore keep an overview of its transfers and a plan B, such as fallback standard clauses, so it does not have to switch suppliers in a hurry when things change.