Regulation and data
International data transfer
An international transfer is sending personal data to a recipient in a third country, outside the European Economic Area (the EU, Iceland, Liechtenstein and Norway), or to an international organisation. The GDPR allows it only with an adequacy decision, appropriate safeguards or a listed exception.
Also known astransfer to a third country · data transfer outside the EU · transferencia internacional
Which door it can leave by
Chapter V of the GDPR sets out the routes, and every transfer has to go through one of them, including any the recipient later makes to another country (art. 44):
- Adequacy decision (art. 45): the Commission declares that the destination protects data adequately, and no authorisation is needed. The list the AEPD publishes includes, for example, Switzerland, Japan, the United Kingdom and the EU-US Data Privacy Framework, with a decision of 10 July 2023.
- Appropriate safeguards (art. 46): the most used are the standard contractual clauses; also binding corporate rules within a group (art. 47), codes of conduct or certifications.
- Derogations for specific situations (art. 49), such as explicit consent after being told the risks, or what is necessary to perform a contract with the person.
Worth knowing
They reach a centre through its suppliers. If the software, email service or AI model a processor uses handles data outside the EEA, that is a transfer the centre authorises in the DPA and that has to appear in its ROPA. The useful thing is to ask, supplier by supplier, where the data are processed and under what safeguard. And an order from a court or authority of a third country is not enough on its own to hand data over to it: it needs an international agreement (art. 48).
Sources
Related terms
- GDPRThe GDPR is Regulation (EU) 2016/679, the EU rule that governs the processing of personal data. It has applied directly since 25 May 2018, and in Spain the LOPDGDD completes it. It binds a colegio mayor, a private student residence and a coliving in exactly the same way.
- Standard contractual clausesStandard contractual clauses are model contracts approved by the Commission that provide appropriate safeguards for sending personal data outside the EU when the destination country has no adequacy decision. The ones in force are those of Commission Implementing Decision (EU) 2021/914 of 4 June 2021.