EU GDPR International Transfers and SCCs

Article 44 sets the general rule: Chapter V conditions apply so the level of GDPR protection is not undermined when personal data moves to a third country or international organisation. The first scoping step is therefore factual, not contractual: identify each destination, importer, onward transfer, processing purpose, data category, and recipient role.

The GDPR does not define a transfer. EDPB Guidelines 05/2021, which are regulatory guidance rather than legislation, use three cumulative criteria: the exporter is subject to the GDPR for the processing; it transmits or otherwise makes the data available to a different controller, joint controller, or processor; and that importer is in a third country or is an international organisation. Chapter V can therefore apply even when the importer is itself subject to the GDPR. If there is no separate importer, Chapter V may not apply, but the controller or processor still has to meet the GDPR's other requirements, including security.

Once the transfer is mapped, select the legal route in order. Check for an Article 45 adequacy decision first. If there is no applicable adequacy decision, test Article 46 safeguards such as Commission SCCs, binding corporate rules, approved codes of conduct, or approved certification mechanisms with binding commitments. Treat Article 49 derogations as a separate fallback only when neither Article 45 nor Article 46 supports the transfer.

Article 49 covers specific situations, including explicit consent after the person is informed of transfer risks, certain contracts or pre-contract steps, important public-interest reasons, legal claims, vital interests where consent cannot be given, and transfers from public registers under the stated conditions. Its final compelling-legitimate-interests route is available only when Article 45 and Article 46 cannot be used and none of the other Article 49(1) derogations applies. The transfer must be non-repetitive, concern only a limited number of people, be necessary for compelling interests that are not overridden by their rights, and be supported by an assessment, suitable safeguards, supervisory-authority notice, and data-subject information. Public authorities cannot use that final route when exercising public powers. EDPB derogation guidance says these exceptions must be interpreted restrictively.

An adequacy decision is not a generic country-risk note. It is a Commission determination under Article 45 that a specific country, territory, sector, or international organisation provides an adequate level of protection. The transfer file should cite the decision or Commission adequacy page and explain why the recipient and processing fall inside its coverage.

Adequacy coverage should also be monitored. As of 24 July 2026, the Commission still lists the United States adequacy route only for commercial organisations participating in the EU-US Data Privacy Framework. A vendor onboarding record should therefore verify the recipient's current participation and covered data, cite the applicable decision, and trigger reassessment if the destination, sector, recipient status, or Commission decision changes.

Commission Implementing Decision (EU) 2021/914 provides SCCs for transfers to third countries. The SCC file should show the chosen module, parties, data description, transfer frequency, retention, onward transfers, technical and organisational measures, sub-processor information where relevant, and signatures or accession evidence.

The signed SCCs need an operational file. Clause 14 requires the parties to take account of the transfer's specific circumstances, third-country laws and practices relevant to the transfer, and supplementary contractual, technical, or organisational safeguards. Retain Clause 15 and Clause 16 evidence covering importer notification, public-authority access requests, suspension, and termination.

The EDPB supplementary-measures recommendations describe a sequence that begins with knowing transfers and verifying the transfer tool, then assessing whether third-country law or practice may undermine that tool in the specific transfer. This is the practical core of a transfer impact assessment.

The Schrems II judgment grounds why this assessment matters. For SCC transfers, the level of protection must be essentially equivalent to EU protection, and the assessment must consider both the contractual clauses and relevant aspects of the third country's legal system. If the SCCs cannot be complied with and protection cannot be ensured by other means, transfer suspension or prohibition is part of the control framework.

A transfer approval should be reusable by procurement, security, privacy, product, and customer-facing teams. The evidence should show both the legal transfer tool and the operational facts that make the tool credible for the actual data flow.

Keep the transfer file close to the vendor, product, and data-map records. If a destination, importer, module, data category, security architecture, or onward transfer changes, the record should be reopened before the transfer continues under the old approval.