GDPR – Third Countries

A third country is any country outside the European Economic Area. Personal data may only be transferred there if the conditions in Chapter V (Articles 44–50) are met, so that the level of protection GDPR guarantees is not undermined, including for onward transfers. In the cases below, regulators looked at where the data went, who could access it, and what protected it there.

Which Articles Govern Transfers

What Counts as a Transfer

A transfer is not only an upload to a server abroad. In the TikTok decision, the data was stored in Singapore and the United States, and the Irish Data Protection Commission treated remote access to that data by staff in China as a transfer to China. Article 44 also covers onward transfers, from the first third-country recipient to another.

Organisations whose support teams, developers or group companies outside the EEA can view EEA data should therefore check whether that access is a transfer, even where the data is stored inside the EEA.

Countries With an Adequacy Decision

Where the Commission has adopted an adequacy decision, data can flow as it would within the EEA. As of this review, adequacy covers:

Adequacy decisions are reviewed periodically and can be amended, suspended or revoked (Art. 45(3)–(5)). Check the Commission’s current list before relying on one.

Appropriate Safeguards and Transfer Assessments

Without adequacy, most organisations use the Commission’s standard contractual clauses (SCCs); groups may use binding corporate rules approved under Article 47. Since the CJEU’s Schrems II judgment of 16 July 2020, SCCs remain valid, but only if an equivalent level of protection can be guaranteed in practice.

That requires a transfer impact assessment: an analysis of whether the destination’s laws and practices, including access by public authorities, would undermine the clauses, and which supplementary measures close the gap. In June 2026 the Irish High Court confirmed that a regulator can examine that assessment and find a breach of Article 46 because of gaps in it, without conducting its own review of the foreign law.

Supplementary measures must address the specific risk. In TikTok, encryption and similar measures were general security measures that could not prevent access enabled by the laws in question.

Article 49 Derogations

Where no adequacy decision or safeguard applies, Article 49 allows a transfer in specific situations:

• The data subject’s explicit consent, after being informed of the risks
• Necessity for a contract with the data subject, or in their interest
• Important reasons of public interest
• The establishment, exercise or defence of legal claims
• Vital interests where the data subject cannot give consent
• Transfers from a public register
• As a last resort, compelling legitimate interests: not repetitive, a limited number of data subjects, with suitable safeguards, and the supervisory authority informed

Derogations are not a substitute for a transfer tool. The DPC found TikTok could not rely on them because they apply to occasional transfers, while its transfers were systematic, repetitive and continuous.

The EU-US Data Privacy Framework

The Commission adopted the adequacy decision for the EU-US Data Privacy Framework on 10 July 2023. It covers only US organisations on the DPF list; transfers to anyone else in the US still need SCCs or another Article 46 tool.

On 3 September 2025 the General Court dismissed the Latombe challenge and upheld the framework, assessing it as it stood when adopted. Mr Latombe appealed to the Court of Justice on 31 October 2025 (Case C-703/25 P). The Court of Justice invalidated both previous EU-US frameworks in Schrems I and Schrems II.

Transfers in Your Records and Privacy Notice

Transfers must be documented and disclosed, not only lawful. Your record of processing activities must identify each third country and, for transfers under the second subparagraph of Art. 49(1), document the suitable safeguards (Art. 30(1)(e)). The privacy notice must name the destination countries: TikTok was fined €45.000.000 because its 2021 privacy policy did not name China or explain the remote access.

Real Cases

All three decisions concern transfers after Schrems II. Meta and TikTok relied on SCCs that regulators found were not backed by adequate protection; Uber relied on no transfer tool at all.

See all third country transfer cases →

Recitals That Explain This Issue

Checklist

• Map every flow of EEA data to a third country, including remote access by support, engineering and group teams
• Identify each third-country destination in your record of processing activities (Art. 30(1)(e)) and note the transfer tool relied on
• Check whether the destination has an adequacy decision, and for US recipients, whether they are on the DPF list
• Where you rely on SCCs or BCRs, document a transfer impact assessment of the destination’s laws and practices
• Choose supplementary measures that address the specific risk identified, not only general security
• Use Article 49 derogations only for occasional transfers that fit one of the listed situations
• Name the destination countries and safeguards in your privacy notice (Art. 13(1)(f), 14(1)(f))
• Keep a fallback transfer tool ready for flows that depend on an adequacy decision under legal challenge
• Reassess when the destination’s law changes or a new vendor or team gains access