International Data Transfers
Chapter V logic
Transfers are a separate question from applicability. First check Article 3 - is the exporter subject to the GDPR? Then apply the three criteria from EDPB Guidelines 05/2021: the exporter discloses or makes data available to another party; the importer is a separate controller, joint controller or processor; and the importer is in a third country or an international organisation. An EU controller sending data to its own EU-established processor is not a transfer; moving the same data to that processor's overseas affiliate is. Mechanisms, strongest first: adequacy decision under Article 45; Article 46 safeguards (standard contractual clauses, binding corporate rules, approved codes with binding commitments, certification); and Article 49 derogations, which are exceptional rather than a routine channel.
Schrems and after
Schrems I (2015) invalidated Safe Harbor. Schrems II (2020) invalidated the Privacy Shield and confirmed that SCCs remain valid but require a case-by-case transfer impact assessment: know the transfer, verify the mechanism, assess third-country law and public authority access, adopt supplementary measures where needed, and monitor. The EU–US Data Privacy Framework (2023) restored an adequacy route for certified US organisations. Remember onward transfers, and that foreign government access counts as an exposure even when no file is actively sent.
Traps
Adequacy decisions can be annulled. Article 49(1) consent must be explicit and informed of the risks. The “compelling legitimate interests” derogation is non-repetitive and limited in scope. The transfer impact assessment is not optional paperwork attached to SCCs, and a vendor's self-certification is not a Commission decision.