Transfers to Third Countries (Data Export)

Where personal data are transferred to a country outside the EU and the European Economic Area, additional requirements apply (Chapter V of the GDPR, Articles 44 to 49 GDPR). The rationale is that the level of protection afforded by the GDPR must be maintained even where the data leave the immediate scope of EU law. This page explains when a data export actually occurs and guides you through the assessment framework. The individual instruments are dealt with on the subpages.

1. When does a data export occur

Three conditions must coincide for the special rules of Chapter V to apply: there must be (3.) a transfer of (1.) personal data (2.) to a recipient in an unsafe third country. If one of these conditions is not met, the transfer is to be treated like a transfer within Germany.

1.1 Transfer: the possibility of access is sufficient

For a transfer to exist, it is sufficient that a recipient in the third country accesses or is able to access the personal data. Actual access is not required. This covers in particular sending data by post or as an email attachment, granting access rights, and operating servers on which the data are stored.

The storage location of the data is not a decisive criterion. In legal terms, a transfer also takes place where the data are physically stored on computers in the EU but a company in the third country is able to access them, or where the contractual partner is a company in the third country.

A transfer also exists where it is not the company itself that passes the data to the third country, but a processor in the EU which in turn engages a sub-processor in the third country. That transfer is attributed to the controller; the controller remains responsible and must ensure that the requirements of Chapter V are met.

By contrast, there is no transfer where the access takes place within the same legal person. If other departments of the same company access the data, or if an employee retrieves the data while on a business trip in a third country, there is no disclosure to another recipient. The decisive factor is the boundary of the legal person, not the place where the person happens to be.

1.2 Third country and unsafe third country

A third country is any country outside the EU and the European Economic Area. In addition to the EU Member States, the EEA comprises Iceland, Norway and Liechtenstein; transfers to those countries are to be treated like domestic transfers.

Within the group of third countries, a further distinction must be drawn:

• Safe third country: an adequacy decision of the European Commission under Article 45 GDPR exists for that country. The European Commission has determined that the country ensures an adequate level of protection. The transfer is then to be treated like a domestic transfer; additional safeguards are not required.
• Unsafe third country: no adequacy decision exists for that country. Here the special requirements of Chapter V apply. Unsafe third countries include, for example, China, Russia, India and Mexico.

The following overview shows the countries covered by an adequacy decision. The position may change; what is decisive is the current list published by the European Commission.

The United States is therefore a special case: it is not a safe third country across the board. An adequacy decision exists only for recipients that are certified under the EU-US Data Privacy Framework. Transfers to non-certified US recipients remain transfers to an unsafe third country.

1.3 Personal data

This covers all information that can be attributed to a natural person. Even simple details such as name, function, business email address or contact details of employees, customers or business partners fall within this scope, as do access credentials and the content of emails and chats.

Pseudonymized or encrypted data also remain personal data as long as the link to a person can be restored. The special rules of Chapter V therefore apply to them as well. Pseudonymization or encryption may, however, be taken into account as a protective measure within the transfer impact assessment.

2. The assessment framework

Once it is established that personal data are being transferred to an unsafe third country, whether and how the transfer is permissible is assessed in three stages.

• Stage 1: is there a transfer to an unsafe third country? If the transfer goes to the EU, the EEA or a safe third country, no special requirements apply (see section 1).
• Stage 2: does a derogation under Article 49 GDPR apply? The derogations are to be interpreted narrowly and generally justify only occasional transfers. For details, see the subpage Derogations under Article 49 GDPR.
• Stage 3: how is an adequate level of protection established? If no derogation applies, appropriate safeguards under Article 46 GDPR are required. In practice, three instruments come into consideration: the Data Privacy Framework (only for certified US recipients), the EU standard contractual clauses together with a transfer impact assessment or, exclusively for intra-group transfers, Binding Corporate Rules.

3. Overview of the appropriate safeguards under Article 46

Where neither an adequacy decision nor a derogation applies, the adequate level of protection must be established by way of an appropriate safeguard under Article 46 GDPR. The GDPR provides several instruments for this purpose. They fall into safeguards that require no authorization and safeguards that are subject to authorization.

Not subject to authorization (Article 46(2) GDPR), that is, usable without a separate authorization from the supervisory authority:

• a legally binding and enforceable instrument between public authorities or bodies (point (a)),
• Binding Corporate Rules under Article 47 GDPR (point (b)),
• standard contractual clauses adopted by the European Commission (point (c)),
• standard data protection clauses adopted by a supervisory authority and approved by the Commission (point (d)),
• an approved code of conduct under Article 40 GDPR together with binding commitments of the recipient (point (e)),
• an approved certification mechanism under Article 42 GDPR together with binding commitments of the recipient (point (f)).

Subject to authorization (Article 46(3) GDPR), that is, usable only with the prior authorization of the supervisory authority: individually negotiated contractual clauses between the exporter and the importer, as well as provisions in administrative arrangements between public authorities. Because of the considerable review effort involved, these play hardly any role in practice.

In corporate practice, three instruments carry the load: the Data Privacy Framework (certified US recipients only), the EU standard contractual clauses and, exclusively for intra-group purposes, Binding Corporate Rules. These are dealt with on the subpages.

4. Accompanying obligations

A permissible data export is not exhausted by the choice of the right instrument. Three obligations are added to it:

• A separate legal basis is required (two-stage assessment). The supervisory authorities understand the lawfulness of a data export as a two-stage assessment. At the first stage, the transfer must, like any processing operation, be covered by a legal basis under Article 6 GDPR. At the second stage, an adequate level of protection in the third country must additionally be ensured. The appropriate safeguards under Article 46 GDPR and a certification under the Data Privacy Framework concern only the second stage; they do not replace the legal basis required at the first stage.
• Documentation in the records of processing activities. Transfers to third countries must be documented in the records of processing activities (Article 30 GDPR), including the destination country and the basis of the transfer (adequacy decision, derogation or appropriate safeguard).
• Transparency towards data subjects. The privacy notice must state that data are transferred to a third country, to which country, and whether an adequacy decision exists or how an adequate level of protection is otherwise established (Article 13(1)(f) GDPR). This information obligation is unaffected by the derogations in Article 49 GDPR.

5. Structure of this chapter