International Transfer

Legal Framework

Chapter V of the GDPR establishes a tiered framework for transferring personal data outside the EU/EEA. The first mechanism is an adequacy decision under Article 45, whereby the European Commission determines that a third country ensures a level of protection essentially equivalent to EU law.

"the Commission has decided that the third country, a territory or one or more specified sectors within that third country, or the international organisation in question ensures an adequate level of protection"
— GDPR Art. 45

Where no adequacy decision exists, transfers may proceed under Article 47 binding corporate rules or other appropriate safeguards under Article 46, including standard contractual clauses. As a last resort, the narrow derogations in Article 49(1) permit transfers without safeguards only on specified grounds.

"a transfer or a set of transfers of personal data to a third country or an international organisation shall take place only on one of the following conditions:"
— GDPR Art. 49(1)

Key Developments

The CJEU's Schrems II ruling established that SCCs require a case-by-case assessment of the third country's legal framework and that transfers must be suspended where domestic law undermines the contractual safeguards. The Court held:

"a controller or processor may transfer personal data to a third country or an international organisation only if the controller or processor has provided appropriate safeguards"
— Schrems II, CJEU ¶25

The Irish DPA's EUR 1.2 billion fine against Meta confirmed the practical consequence: SCCs supplemented by additional measures may still fall short where the destination country's surveillance regime permits disproportionate government access. The Croatian DPA's EUR 4.5 million fine illustrates enforcement where safeguards lapse:

"transfers continued without SCCs or equivalent safeguards, despite Serbia lacking an adequacy decision"
— AZOP §1

Status of the Debate

This topic is actively contested. Schrems II established the principle that transfer mechanisms must account for third-country surveillance laws, but the practical threshold for when supplementary measures suffice remains unresolved. DPAs have diverged on whether encryption, contractual overrides, or pseudonymisation adequately compensate for government access powers. The Meta decision demonstrates that even well-resourced supplementary measures may not withstand scrutiny. No definitive ruling has clarified the precise boundary; further CJEU guidance or EDPB binding decisions would settle the open question.

Practical Guidance

• Map all cross-border data flows and classify each by mechanism: Article 45 adequacy, Article 47 BCRs, Article 46 SCCs, or Article 49 derogation.

• For SCC-based transfers, conduct a transfer impact assessment examining the destination country's surveillance laws and implement supplementary measures where government access may exceed EU proportionality standards.

• Treat Article 49(1) derogations as exceptional — explicit consent and contractual necessity require case-by-case justification and cannot serve as routine transfer bases.

• For intra-group transfers, pursue Article 47 BCRs approved through the Article 63 consistency mechanism, which provide uniform guarantees across all third countries regardless of local protection levels.

• Document every transfer decision, including legal basis, risk assessment, supplementary measures, and supervisory authority notification where Article 49(5) applies.