In This Guide
Transfer Rules Overview
GDPR Chapter V restricts transfers of personal data to countries outside the EEA unless appropriate safeguards are in place. Following the Schrems II judgment, organizations must take additional steps to ensure data remains protected.
Transfer Mechanisms (in preference order)
- Adequacy decision: Commission has determined adequate protection
- Appropriate safeguards: SCCs, BCRs, codes of conduct, certification
- Derogations: Explicit consent, contract necessity, public interest (limited)
Adequacy Decisions
Countries with adequacy decisions can receive data without additional safeguards:
- Andorra, Argentina, Canada (commercial), Faroe Islands
- Guernsey, Israel, Isle of Man, Japan, Jersey
- New Zealand, Republic of Korea, Switzerland
- United Kingdom (until 2025), Uruguay
- USA (via EU-US Data Privacy Framework for participating companies)
Standard Contractual Clauses (SCCs)
The 2021 SCCs are the most common transfer mechanism. They come in modular form:
SCC Modules
| Module | Transfer Type |
|---|---|
| Module 1 | Controller to Controller |
| Module 2 | Controller to Processor |
| Module 3 | Processor to Processor |
| Module 4 | Processor to Controller |
SCC Implementation Steps
- Identify all transfers outside EEA
- Determine transfer type (C2C, C2P, etc.)
- Select appropriate module
- Complete Annex I (parties, data details)
- Complete Annex II (technical/organizational measures)
- Conduct Transfer Impact Assessment
- Implement supplementary measures if needed
- Sign SCCs with data importer
Transfer Impact Assessments (TIA)
Following Schrems II, you must assess whether the destination country provides essentially equivalent protection. A TIA evaluates whether SCCs can be complied with in practice.
TIA Steps
- Know your transfers: Map all transfers, data types, purposes
- Identify the transfer tool: SCCs, BCRs, etc.
- Assess destination country law: Focus on government access powers
- Assess if importer can comply with SCCs: Given local laws
- Identify supplementary measures: If needed to fill gaps
- Re-evaluate at appropriate intervals: Or when circumstances change
Key Assessment Questions
- Does the destination country have mass surveillance laws?
- Can authorities compel access without judicial oversight?
- Is there effective redress for EU data subjects?
- What is the practical likelihood of government access?
- What type of data is being transferred?
Supplementary Measures
Where TIA identifies gaps, supplementary measures may help:
Technical Measures
- Strong encryption (with keys retained in EEA)
- Pseudonymization (with key kept separate)
- Split processing (sensitive elements remain in EEA)
Organizational Measures
- Policies restricting onward transfers
- Transparency reporting
- Procedures to challenge government requests
Contractual Measures
- Commitment to notify of government requests (where legally possible)
- Commitment to challenge unlawful requests
- Audit rights
Practical Steps
Immediate Actions
- Create a transfer register (all non-EEA transfers)
- Identify current transfer mechanisms
- Update to 2021 SCCs if still using old versions
- Conduct TIAs for each transfer
- Document assessment and decisions
Ongoing Obligations
- Monitor regulatory developments (new adequacy decisions, guidance)
- Re-assess when circumstances change
- Include transfer assessment in vendor due diligence