Data transfers to third countries

In short: Personal data may only be transferred to countries outside the EU if an adequate level of protection is ensured there.

In more detail: This can be done through an adequacy decision of the EU Commission (for example for countries such as Switzerland or, with certification, the USA under the “Data Privacy Framework”), through standard contractual clauses (SCC) with additional measures or through binding corporate rules.

Not legal advice. The legal situation changes, check current decisions.

In Depth

• Schrems II (2020): The CJEU struck down the “Privacy Shield”. Since then, the USA and other countries require careful assessment.
• Data Privacy Framework (2023): adequacy decision for certified US companies.
• Transfer impact assessment: examination of whether state access in the destination country undermines the safeguards.
• In practice: Choose EU servers where possible. Encrypt so the provider cannot read along.
• Embedded services: Fonts, maps, videos and analytics scripts can also transfer data to third countries (Google Fonts and data protection).

See also: Data processing agreement, GDPR: principles and legal bases