Chapter V
Moving personal data outside the EU.
Personal data can leave the EU/EEA only through a safeguard: an adequacy decision, Standard Contractual Clauses (SCCs), Binding Corporate Rules (BCRs), or a narrow derogation. Since the Schrems II ruling, you must also check that the destination's laws don't undercut the safeguard.
Back to GDPR services01 · Safeguards
The four routes out
No safeguard, no transfer.
- Adequacy decision
- The Commission recognizes the country's protection as essentially equivalent. Data flows as if within the EU.
- Standard Contractual Clauses
- EU-approved contract terms between exporter and importer, plus a transfer impact assessment.
- Binding Corporate Rules
- Group-wide rules for multinationals, approved by a supervisory authority.
- Derogations
- Narrow exceptions such as explicit consent for occasional transfers. Not for routine flows.
02 · Transfer impact
Transfer impact assessments
Does the destination's law let the safeguard work?
- Map the transfer: what data, to whom, where, and onward.
- Identify the transfer tool you rely on.
- Assess the destination's laws, especially government access.
- Add supplementary measures where needed, such as encryption you control.
- Record it, and re-assess when things change.
03 · Choosing a route
Picking the route for a given flow
Work down the list; stop at the first route that holds.
| Situation | Usual route | Extra work |
|---|---|---|
| Recipient in a country with an adequacy decision | Adequacy | Check the decision covers your recipient and sector |
| Vendor outside the EU with no adequacy | SCCs | Pick the right module and run a TIA |
| Group companies sharing HR and customer data worldwide | BCRs | Authority approval takes a long road, so plan early |
| A one-off transfer to settle a legal claim | Derogation | Keep it occasional and document why |
The SCCs come in modules for the roles on each side: controller to controller, controller to processor, processor to processor and processor to controller. Choosing the wrong module is a common slip, so match it to the actual roles first.
04 · A worked scenario
Illustrative: a support desk in India
Remote access counts as a transfer.
Illustrative: a European online retailer uses an Indian outsourcing team to answer customer tickets. The data is stored on servers in Frankfurt, but agents in India open tickets and see names, addresses and order history. That is a transfer, even though nothing is copied across, because the data is made accessible from outside the EU.
- Name the roles. The retailer is controller; the outsourcer is its processor.
- Sign the right SCC module. Controller to processor, attached to the Article 28 agreement.
- Assess the destination. Record how Indian law lets public bodies reach data, and the technical limits you set.
- Add supplementary measures. Role-based access, masked fields, session logging and no local downloads.
- List onward transfers. Any sub-contractor the outsourcer uses must be bound the same way.
05 · Mistakes and India
Common mistakes, and the Indian side
Most gaps are in inventory, not in the contract.
- Counting only storage. Remote support access and analytics tools are transfers too.
- Signed SCCs, no assessment. The contract alone does not prove the destination's laws allow it to work.
- Forgetting onward transfers. Your processor's vendors are part of your chain.
- Relying on a derogation for routine flows. Regulators read these exceptions narrowly.
Going the other way, India's Digital Personal Data Protection Act, 2023 lets personal data move abroad except to countries the government restricts by notification, while other sector rules may still require local storage. An Indian company serving EU customers must satisfy both directions.
Sources: Regulation (EU) 2016/679, Chapter V (Articles 44 to 49); Commission Implementing Decision (EU) 2021/914 on SCCs; EDPB Recommendations 01/2020 on supplementary measures; Digital Personal Data Protection Act, 2023. This page is general information, not legal advice; counsel should confirm how it applies to your contracts.
More about transfers
Is using a US cloud provider a transfer?
Often, yes, if data is accessed or stored outside the EU.
Check where data is stored and accessed, including support access. Use the provider's transfer mechanism, an adequacy framework where one applies or SCCs, and record your assessment.
Do we need a fresh assessment for each SCC contract?
For each distinct transfer, yes, but you can reuse the reasoning.
Transfers to the same country with the same data and tool can share one documented assessment. Review it when laws or the flow change.
Does an adequacy decision last forever?
No. The Commission reviews it and can withdraw it.
Keep a watch on decisions you depend on and a fallback such as SCCs.
What is the role of the exporter's representative?
It is a different thing from a transfer tool.
A non-EU business that falls under the GDPR may need an EU representative under Article 27. That does not replace a safeguard for outgoing data.
Map every transfer before a regulator does.
A GDPR gap assessment inventories your transfers and the safeguard behind each one.