GDPR Chapter V — Transfers of personal data to third countries
Articles 44–49 of Regulation (EU) 2016/679. One principle sits above everything: personal data may leave the EU only if one of the mechanisms applies — and it must keep its protection level as it travels.
In one line
The EU runs a country-level trust model plus standardised contracts: if the destination has an adequacy decision, data flows; if not, you need safeguards such as standard contractual clauses, and only in narrow cases a derogation.
The mechanisms
| Article | Mechanism | Notes |
|---|---|---|
| 44 | General principle | Any transfer, including onward transfers, must maintain the level of protection. |
| 45 | Adequacy decision | The Commission finds a country, territory or sector provides an essentially equivalent level of protection. No further authorisation needed. |
| 46 | Appropriate safeguards | Standard contractual clauses (SCCs), binding corporate rules (BCRs, requiring Article 47 approval), approved codes of conduct, certification — plus enforceable data-subject rights and effective remedies. |
| 47 | Binding corporate rules | For intra-group transfers by multinationals. |
| 49 | Derogations | Explicit consent, necessity for a contract or its performance, important reasons of public interest, legal claims, vital interests, public registers — narrow and read restrictively. |
Practical history worth knowing
- Schrems II (2020) invalidated the Privacy Shield and hardened transfer impact assessments; the SCCs were revised and reissued in 2021.
- EU–US Data Privacy Framework (adequacy decision, July 2023) restored a route for certified US recipients — and remains contested.
Where the friction lands
- Adequacy is a political, country-level judgement, so it moves slowly and is vulnerable to litigation.
- SCCs are standardised by the Commission, which means the contract is largely non-negotiable.
- Transfers within a multinational group usually require BCRs — a heavy authorisation process.
Unverified / TODO
- List the current adequacy decisions with dates
- Note the status of the EU–US Data Privacy Framework and any pending challenge
- Summarise the 2021 SCC modules (controller-to-controller, controller-to-processor, etc.)
Source quotes
Any transfer of personal data which are undergoing processing or are intended for processing after transfer to a third country or to an international organisation shall take place only if, subject to the other provisions of this Regulation, the conditions laid down in this Chapter are complied with by the controller and processor— Article 44 — the general principle the whole chapter rests on (snapshot:snapshots/eu/gdpr.txt)In the absence of a decision pursuant to Article 45(3), a controller or processor may transfer personal data to a third country or an international organisation only if the controller or processor has provided appropriate safeguards, and on condition that enforceable data subject rights and effective legal remedies for data subjects are available.— Article 46(1) — the safeguards route the card's Article 46 row describes (snapshot:snapshots/eu/gdpr.txt)