A Chapter V guide for deciding whether a transfer can rely on an adequacy decision, SCCs, another Article 46 safeguard, or a narrow Article 49 derogation.
Built for privacy, legal, procurement, security, product, and data-governance teams that need a defensible transfer file instead of a one-line vendor approval.
Structured answer sets in this page tree.
Cited legal and guidance references.
GDPR Chapter V is the transfer gate for personal data sent to a third country or international organisation. A useful transfer record should show the destination, recipient, data categories, transfer tool, data-subject information, and the assessment behind any SCC or supplementary-measures decision.
Article 44 sets the general rule: Chapter V conditions apply so the level of GDPR protection is not undermined when personal data moves to a third country or international organisation. The first scoping step is therefore factual, not contractual: identify each destination, importer, onward transfer, processing purpose, data category, and recipient role.
Once the transfer is mapped, select the legal route in order. Check for an Article 45 adequacy decision first. If there is no applicable adequacy decision, test Article 46 safeguards such as Commission SCCs, binding corporate rules, approved codes of conduct, or approved certification mechanisms with binding commitments. Treat Article 49 derogations as a separate fallback only when neither Article 45 nor Article 46 supports the transfer.
An adequacy decision is not a generic country-risk note. It is a Commission determination under Article 45 that a specific country, territory, sector, or international organisation provides an adequate level of protection. The transfer file should cite the decision or Commission adequacy page and explain why the recipient and processing fall inside its coverage.
Adequacy coverage should also be monitored. The Commission page describes periodic review, and it identifies adequacy decisions and related review material. A vendor onboarding record should therefore include an adequacy-status check and a trigger to reassess if the destination, sector, recipient status, or Commission decision changes.
Commission Implementing Decision (EU) 2021/914 provides SCCs for transfers to third countries. The SCC file should show the chosen module, parties, data description, transfer frequency, retention, onward transfers, technical and organisational measures, sub-processor information where relevant, and signatures or accession evidence.
SCCs are not just contract paper. Clause 14 requires the parties to take account of the transfer's specific circumstances, third-country laws and practices relevant to the transfer, and supplementary contractual, technical, or organisational safeguards. Clause 15 and Clause 16 evidence should also be retained because importer notification, public-authority access requests, suspension, and termination are part of the operational control set.
The EDPB supplementary-measures recommendations describe a sequence that begins with knowing transfers and verifying the transfer tool, then assessing whether third-country law or practice may undermine that tool in the specific transfer. This is the practical core of a transfer impact assessment.
The Schrems II judgment grounds why this assessment matters. For SCC transfers, the level of protection must be essentially equivalent to EU protection, and the assessment must consider both the contractual clauses and relevant aspects of the third country's legal system. If the SCCs cannot be complied with and protection cannot be ensured by other means, transfer suspension or prohibition is part of the control framework.
A transfer approval should be reusable by procurement, security, privacy, product, and customer-facing teams. The evidence should show both the legal transfer tool and the operational facts that make the tool credible for the actual data flow.
Keep the transfer file close to the vendor, product, and data-map records. If a destination, importer, module, data category, security architecture, or onward transfer changes, the record should be reopened before the transfer continues under the old approval.
No. For SCC transfers, the file should document the specific transfer circumstances, the relevant third-country law and practice, and whether supplementary measures are needed so the transfer tool remains effective.
Only when the transfer is to a US company that participates in the EU-US Data Privacy Framework and the transfer is covered by that participation. Other US transfers still need a separate Chapter V route, such as SCCs with assessment and safeguards.
The strongest file links the signed SCC module and annexes to the transfer inventory, importer input, Clause 14 assessment, supplementary measures, notice language, access-request handling, and a review trigger.
Sorena can help convert the transfer inventory, adequacy check, SCC module, TIA, supplementary measures, and review triggers into a cited workflow for privacy, legal, procurement, and security teams.
Ask source-linked questions about adequacy, SCC modules, transfer impact evidence, supplementary measures, and EU-US DPF coverage.
Review your international-transfer inventory, SCC file structure, and transfer-impact assessment evidence with Sorena.
"essentially equivalent"
"The Parties warrant"
"re-evaluate at appropriate intervals"
"Article 45"
"companies in the United States that participate"
"pre-approved"
"means by which to obtain a copy"
"Transfers subject to appropriate safeguards"