Transferring Personal Data Outside the EU: What GDPR Requires

Update: October 2026

Chapter V of the GDPR restricts transferring personal data to countries outside the EU and EEA. A transfer is lawful only if it fits one of a short list of routes, and the exporter must show which one it used.

This guide covers those routes, the transfer assessment that sits behind them, the 2025 and 2026 changes that matter, and the separate UK regime.

Key Takeaways

• Chapter V (Articles 44 to 49) allows a transfer to a country outside the EEA only on an adequacy decision, appropriate safeguards such as the Commission’s standard contractual clauses, or a listed derogation. The exporter has to identify the route used and keep a record.

• The EU-US Data Privacy Framework adequacy decision of 10 July 2023 stands. The General Court dismissed a challenge to it in September 2025, and the Court of Justice is now hearing the appeal (Case C-703/25 P). Organisations that depend on it should keep standard contractual clauses and a transfer assessment as a fallback.

• The UK runs its own regime. Since the Data (Use and Access) Act 2025, UK legislation calls the transfer risk assessment a “data protection test”, and the ICO updated its international transfers guidance in January 2026. The EU renewed its adequacy decisions for the UK on 19 December 2025, valid until 27 December 2031.

A Transfer Happens When Data Reaches a Recipient in a Third Country

Chapter V applies when personal data is sent to, or made accessible to, a recipient in a country outside the EEA. That includes a supplier in India that supports your helpdesk, a US cloud provider with servers or support staff outside the EEA, and a group company that accesses your HR system from another continent. Remote access from a third country counts.

First, map your transfers. List each supplier and group entity, the categories of data, where the recipient is established, where support staff can reach the data from and which sub-processors are used. Our guide to video conferencing and GDPR shows what this looks like for one common tool.

Adequacy Decisions Let Data Flow Without Further Safeguards

Under Article 45, the Commission can decide that a country ensures an adequate level of protection. Data can then flow to that country without additional safeguards. The list includes the UK, whose decision the Commission renewed on 19 December 2025 until 27 December 2031, and the United States for organisations certified under the EU-US Data Privacy Framework.

The Data Privacy Framework decision was adopted on 10 July 2023. The General Court dismissed an action against it on 3 September 2025, and the applicant lodged an appeal at the Court of Justice on 31 October 2025, registered as Case C-703/25 P, according to the notice in the Official Journal. Check the Court’s register for its current stage.

Two earlier frameworks fell at this court: Safe Harbour in 2015 and Privacy Shield in 2020. Organisations that rely on the Framework alone should keep a second route available.

Standard Contractual Clauses Are the Most Common Safeguard

Under Article 46, the exporter can use appropriate safeguards where no adequacy decision applies. The most used safeguard is the Commission’s standard contractual clauses (SCCs). On 4 June 2021, the Commission issued modernised SCCs for transfers from controllers or processors in the EU/EEA to controllers or processors outside it, and the Commission’s SCC page says they replace the three sets adopted under the old Directive 95/46.

The 2021 SCCs are modular. The parties pick the module that matches the roles: controller to controller, controller to processor, processor to processor, or processor to controller. Signing the wrong module, or leaving the annexes blank, is a common error. The annexes must list the parties, the data, the purposes and the security measures.

Other Article 46 safeguards include binding corporate rules for transfers within a corporate group, approved codes of conduct and certification mechanisms.

A Transfer Assessment Is Part of Using SCCs

In July 2020, the Court of Justice invalidated the Privacy Shield in the Schrems II judgment (Case C-311/18) and held that SCCs remain valid. It also held that the exporter, with the importer’s help, must check whether the destination country’s law and practice allow compliance with the clauses, and add supplementary measures where they do not. After the ruling, the EDPB published Recommendations 01/2020 on supplementary measures, and the 2021 SCCs build the assessment into the contract.

A practical assessment records the destination country’s laws on government access, the type of data, the likelihood of access requests, the technical measures such as encryption where the importer lacks the keys, and the conclusion. If the assessment shows protection cannot be assured, the transfer has to stop or change.

Derogations Cover Limited Cases Only

Article 49 allows transfers without an adequacy decision or safeguards in specific cases, such as explicit consent after being told of the risks, performance of a contract with the person, or the establishment, exercise or defence of legal claims. The EDPB reads these narrowly. They suit occasional transfers and do not support systematic, repeated transfers to a supplier.

The UK Has Its Own Transfer Regime

UK GDPR Chapter V applies to restricted transfers out of the UK. The routes mirror the EU’s: UK adequacy regulations (including the UK extension for certified US organisations), appropriate safeguards such as the UK International Data Transfer Agreement (IDTA) and the UK Addendum to the EU SCCs, and exceptions.

The Data (Use and Access) Act 2025 changed the language of the assessment. The ICO’s international transfers guidance, updated on 15 January 2026, now refers to a transfer risk assessment in UK legislation as a “data protection test”, although the ICO still uses the term transfer risk assessment. The guidance is split into sections on adequacy, appropriate safeguards, completing an assessment, using an exception and receiving data from the EEA, and the ICO offers a transfer risk assessment tool.

For data coming the other way, the ICO confirms that the European Commission adopted renewed adequacy decisions for the UK on 19 December 2025, which last until 27 December 2031. They allow personal data to flow from the EEA to the UK without additional safeguards.

UK organisations that already hold IDTAs, Addenda and assessments should review them against the ICO’s updated guidance.

A Short Transfer Register Supports Every Route

Keep one register with the supplier, the country, the data, the route relied on, the safeguards, the assessment and its date, and the review date. Check contracts for sub-processors in third countries, since a processor’s own transfers also need a route. Review the register when a provider changes its hosting, when an adequacy decision changes and when a court ruling lands.

GDPRLocal helps organisations map transfers, complete assessments and update contracts. See our GDPR consultant services and our guide to data protection after the UK left the EU.

Conclusion

A lawful transfer starts with knowing where your data goes and which Chapter V route covers each destination. Adequacy is the simplest route. SCCs with a documented assessment are the standard fallback, and derogations suit one-off cases only.

The position changes as courts and regulators act. The Data Privacy Framework appeal is pending, the UK has a new test, and regulators expect organisations to account for staff remote access from third countries. A current register, a signed set of clauses and a dated assessment put an organisation in a position to adjust.

Frequently Asked Questions

Can We Still Transfer Personal Data to the United States?

Yes, if a Chapter V route covers the transfer. Certified recipients can rely on the EU-US Data Privacy Framework adequacy decision, which is under appeal in Case C-703/25 P. Others need standard contractual clauses and a documented transfer assessment.

Do We Need a Transfer Assessment for Every Supplier Outside the EU?

You need one wherever you rely on appropriate safeguards such as SCCs and no adequacy decision covers the transfer. The assessment considers the destination country’s laws and practices, the data, and the technical protections, and you must record the conclusion.

Do UK Organisations Follow the Same Rules?

The UK has its own regime under the UK GDPR and the Data Protection Act 2018, with the IDTA and the UK Addendum to the EU SCCs as common safeguards. UK legislation now calls the transfer risk assessment a data protection test, and the ICO’s international transfers guidance explains how to complete one.

Disclaimer: This blog post is intended solely for informational purposes. It does not offer legal advice or opinions. This article is not a guide for resolving legal issues or managing litigation on your own. It should not be considered a replacement for professional legal counsel and does not provide legal advice for any specific situation or employer.