Short answer
Personal data may be transferred outside the European Economic Area (EEA) only through a route permitted by Chapter V of the General Data Protection Regulation (GDPR), while the rest of the GDPR continues to apply. The EEA comprises the EU Member States plus Iceland, Norway and Liechtenstein.
The simplest route is a current European Commission adequacy decision covering the destination and transfer. Without one, the exporter normally needs an Article 46 safeguard, such as binding corporate rules or the Commission's standard contractual clauses (SCCs), together with enforceable rights and effective remedies. In Data Protection Commissioner v Facebook Ireland and Maximillian Schrems, Case C-311/18 (Schrems II), the Court of Justice held that signing SCCs is not enough by itself. The exporter must assess, case by case, whether the destination's law and practices allow the chosen safeguard to work in reality and add effective supplementary measures where necessary.
Measures can be technical, contractual and organisational. Encryption or pseudonymisation may work where the recipient cannot obtain intelligible data or keys. Contracts cannot bind a foreign public authority. If cleartext access and problematic surveillance law coincide, the transfer may need to be stopped. Article 49 derogations remain exceptional, not a routine outsourcing route.
What is a transfer outside the EEA?
Chapter V applies when a controller or processor makes personal data available to a recipient in a third country or international organisation, including through onward transfers. Remote access from a third country can matter even if the server remains in Europe. The EDPB describes the EEA as the EU plus Iceland, Norway and Liechtenstein and explains that the GDPR applies in those three states through the EEA Agreement.
Article 44 states the controlling principle:
“All provisions in this Chapter shall be applied in order to ensure that the level of protection of natural persons guaranteed by this Regulation is not undermined.” —
A transfer mechanism does not replace the remaining GDPR duties. The exporter still needs a lawful basis, transparency, purpose limitation, data minimisation, security and processor arrangements where applicable. It should first map the data, recipients, storage, remote access and onward transfers rather than treating the supplier's billing address as decisive.
Route one: a current adequacy decision
Under Article 45, the Commission may decide that a country, territory, specified sector or international organisation ensures an adequate level of protection. A transfer within the decision's scope then needs no specific authorisation under Chapter V.
The exporter should verify the decision's scope, conditions and recipient requirements. Decisions may be amended, suspended or repealed, so the check must be revisited. Adequacy does not excuse other GDPR failures.
For US transfers, Decision (EU) 2023/1795 covers only certified EU-US Data Privacy Framework organisations and in-scope data. In Latombe v Commission, Case T-553/23, the General Court dismissed an annulment action in 2025. Exporters must still verify the recipient and transfer and monitor later developments.
Route two: appropriate safeguards under Article 46
Where no adequacy decision covers the transfer, Article 46(1) provides the general route:
“In the absence of a decision pursuant to Article 45(3), a controller or processor may transfer personal data to a third country or an international organisation only if the controller or processor has provided appropriate safeguards, and on condition that enforceable data subject rights and effective legal remedies for data subjects are available.” —
Safeguards include binding corporate rules, Commission SCCs, approved supervisory-authority clauses, approved codes or certification mechanisms with binding commitments, and certain public-authority instruments. Bespoke contractual clauses can require supervisory approval.
The current Commission SCCs are in Implementing Decision (EU) 2021/914, with modules covering the four controller/processor combinations. Parties must select the correct module and complete the annexes accurately. The old SCC decisions were repealed and their transition ended on 27 December 2022.
What did Schrems II change?
In its Grand Chamber preliminary ruling of 16 July 2020, the Court upheld the former SCC decision but invalidated the EU-US Privacy Shield decision. Third-country protection need not be identical to EU law, but must be essentially equivalent with the contractual safeguards.
SCCs bind their parties; they do not bind a third country's intelligence agencies or legislature. The assessment must therefore consider both the contract and the law and practices affecting the recipient. The Court explained that SCCs:
“may require, depending on the prevailing position in a particular third country, the adoption of supplementary measures by the controller in order to ensure compliance with that level of protection.” —
The exporter or processor bears the initial responsibility for case-by-case verification, where appropriate with the recipient. If adequate additional measures cannot be taken, the transfer must be suspended or ended. A competent supervisory authority must also suspend or prohibit a transfer where EU-required protection cannot otherwise be ensured. The Court interpreted EU law on a reference from the Irish High Court; it did not decide the final national dispute.
How should a transfer impact assessment be carried out?
The 2021 SCCs convert the Schrems II analysis into express contractual duties. Clause 14 requires the parties to warrant that they have no reason to believe that destination-country laws and practices prevent the importer from fulfilling the clauses. They must consider the transfer's circumstances, the relevant legal framework and any contractual, technical or organisational safeguards. Their conclusion must be documented:
“The Parties agree to document the assessment under paragraph (b) and make it available to the competent supervisory authority on request.” —
A defensible transfer impact assessment should identify:
- the exporter, importer, roles, SCC module and any sub-processors;
- categories and sensitivity of data, affected people, purposes, frequency, scale and retention;
- storage, remote access, onward transfers and where encryption keys are held;
- relevant destination laws and practices, especially public-authority access, oversight, necessity and proportionality, notification restrictions and available remedies;
- the sources and objective evidence used, any importer experience considered under Clause 14, and why that evidence is reliable; and
- supplementary measures, residual risk, approvals, review triggers and the decision to proceed, change or stop.
The assessment must connect the actual flow to the legal powers and safeguards affecting it. The importer must notify the exporter if it becomes unable to comply.
Which supplementary measures can be effective?
EDPB Recommendations 01/2020 Version 2.0 provide a non-binding six-step method: map transfers, identify the Chapter V tool, assess destination law and practice, adopt supplementary measures, complete formalities and re-evaluate at appropriate intervals.
The effective measure depends on the use case. Examples in the Recommendations include:
- Strong encryption for storage or backup, where the encryption is robust, the data is not needed in cleartext abroad, and keys remain solely under the exporter's or another adequately protected entity's control.
- Effective pseudonymisation, where the additional information needed for attribution is kept separately in the EEA or an adequate jurisdiction and re-identification is not realistically possible for the importer.
- End-to-end or transport encryption, where data is protected in transit and only an appropriately protected endpoint can decrypt it.
- Split or multi-party processing, where no single recipient receives enough information to reconstruct personal data.
- Contractual and organisational controls, including access limits, audit rights, government-request procedures, staff controls and minimisation, to strengthen technical protection and accountability.
Limits matter. Contractual promises cannot prevent a public authority from exercising binding powers. Encryption at rest or in transit does not solve the problem if the importer must hold the key or access cleartext for the service. For cleartext cloud processing or remote access in a jurisdiction with incompatible public-access rules, the EDPB could identify no effective technical measure for the described use cases. The practical options may be to change the architecture, reduce or anonymise the data, use a different recipient or stop the transfer.
Are Article 49 derogations an alternative?
Article 49 permits specified transfers in the absence of adequacy and Article 46 safeguards—for example, explicit informed consent to the particular risks, necessity for a contract with the data subject, important public-interest grounds, legal claims or vital interests. These derogations are interpreted narrowly. Some are unavailable to public authorities acting within their powers, and several depend on strict necessity rather than convenience.
The residual compelling-legitimate-interests route is narrower still: the transfer must be non-repetitive, concern few data subjects, require balancing and safeguards, and trigger notifications. Article 49 is unsuitable for ordinary global hosting, support or analytics.
Practical transfer checklist
- Map every recipient, remote-access location and onward transfer.
- Confirm that the processing itself satisfies the GDPR and minimise the exported data.
- Check for a current adequacy decision and its exact territorial, sectoral and recipient scope.
- If none applies, select the correct Article 46 tool and SCC module.
- Conduct and retain a transfer-specific assessment of destination law and practices.
- Test whether proposed technical measures prevent the importer and public authorities from receiving intelligible data where required.
- Complete SCC annexes, processor terms, approvals and operational controls accurately.
- Build notification, audit, review, suspension, deletion or return, and vendor-exit procedures.
- Reassess when laws, practices, vendors, sub-processors, data or architecture change.
- Do not begin—or suspend—the transfer if essentially equivalent protection cannot be achieved.
Conclusion
The Chapter V route must work for the real data flow. SCCs require a documented assessment of destination law and practice. If cleartext access and incompatible law defeat the safeguards, redesign or stop the transfer. Article 49 remains exceptional.
Sources
This article provides general legal information, not advice for a specific matter. Laws, facts and procedural deadlines may change the result. Follow the linked primary sources and obtain local advice before acting.