Data Transfers

Data Transferring in EU and Outside EU under GDPR

The General Data Protection Regulation (GDPR) is a comprehensive data protection regulation that applies to all organizations processing personal data of individuals located in the European Union (EU). The regulation applies to the transfer of personal data both within the EU and outside the EU. In this article, we will explore the rules and regulations around data transferring in the EU and outside the EU under GDPR.

Data Transferring Within EU

Under GDPR, personal data can be transferred freely within the EU. The regulation considers all EU Member States to be ‘adequate’, meaning they provide an adequate level of data protection. This means that organizations do not need to take any additional steps or put in place any additional safeguards when transferring personal data between EU Member States.

Data Transferring Outside EU

Transfers of personal data outside the EU are subject to more stringent rules under GDPR. Such transfers are only allowed if the recipient country provides an adequate level of data protection, as determined by the European Commission. If the recipient country is not considered adequate, the organization must put in place additional measures to ensure the protection of the personal data being transferred.

There are several ways organizations can legally transfer personal data outside the EU, including:

1. Standard Contractual Clauses (SCCs) - SCCs are standard contracts approved by the European Commission that provide adequate safeguards for the transfer of personal data outside the EU.
2. Binding Corporate Rules (BCRs) - BCRs are internal policies and procedures put in place by an organization to ensure the protection of personal data transferred outside the EU. BCRs must be approved by the relevant data protection authority.
3. Derogations - In certain circumstances, organizations may be able to transfer personal data outside the EU without putting in place any additional safeguards, if they can demonstrate that the transfer is necessary for the performance of a contract, to protect the vital interests of the data subject, or to comply with a legal obligation.

Conclusion

In conclusion, the GDPR provides a comprehensive framework for the transfer of personal data both within and outside the EU. Organizations must ensure that they comply with the relevant rules and regulations when transferring personal data outside the EU, in order to protect the privacy of individuals and avoid costly fines.

If you’re not sure about data transfers compliance in your company feel free to send me a message