HumenhukCIPP/E Study Guide
Ch 18.4 - Moving data outside the EEA

Offshoring and international transfers

Reviewed by Victor Humenhuk. Published . Reviewed .

Article 44 limits transfers of personal data outside the EEA unless the transfer meets a Chapter V condition. Available routes include an adequacy decision, the revised modular standard contractual clauses under Article 46, ad hoc clauses approved by a supervisory authority and binding corporate rules for processors. The Commission adopted an adequacy decision for transfers to participating organisations under the EU-US Data Privacy Framework on 10 July 2023.

Article 44 limits transfers outside the EEA unless the third country ensures an adequate level of protection. With cloud computing, overcoming this restriction is the single most difficult compliance aspect for EU customers using overseas suppliers. But it is not an absolute prohibition: Chapter 5 of the GDPR sets out conditions, and several routes exist.

Transfer routes for offshoring
RouteGDPR basisKey feature
Adequacy decision / EU-US Data Privacy FrameworkArt 45Transfers lawful while the decision is valid; US importers must include processing on behalf of customers within their certification
Standard contractual clauses (SCCs)Art 46Revised 4 June 2021; modular approach covering C2C, C2P, P2P and P2C scenarios
Ad hoc / tailored clausesArt 46(3)Negotiated clauses approved by a competent DPA; can suit processor-to-processor transfers
Binding corporate rules for processorsArts 46/47Internal rules tailored to the processor; creates 'safe processors' regardless of location
The four SCC modules (revised 2021)
ModuleTransfer scenario
Controller-to-controllerC2C
Controller-to-processorC2P
Processor-to-processorP2P
Processor-to-controllerP2C
EU-US framework history

Safe Harbor was invalidated in 2015 and the original Privacy Shield in 2020. The Commission adopted Implementing Decision (EU) 2023/1795 on 10 July 2023 for transfers to participating US organisations under the EU-US Data Privacy Framework.

Key terms - quick answers

What is “Article 44”?
GDPR provision restricting transfers of personal data outside the EEA unless the third country ensures an adequate level of protection.
What is “EEA”?
European Economic Area; the geographic zone within which personal data may flow freely.
What is “Adequacy decision”?
A Commission decision (Article 45) that a third country offers an adequate level of protection, allowing transfers without further safeguards.
What is “Standard contractual clauses”?
SCCs adopted by the Commission as appropriate safeguards under Article 46; the revised version (4 June 2021) uses a modular approach.

Sources and study method

This independent lesson uses active recall, spaced retrieval and scenario practice. Read the full study method.