Fiche 27/54
Part 3 — Lawfulness & Key Actors
Advanced
Reviewed 2026-08-23
International Data Transfers Outside the EU (Chapter V)
International Data Transfers Outside the EU (Chapter V)
⚡ In 30 seconds
Under Chapter V (Articles 44 to 50), personal data transferred outside the European Economic Area (EEA) must continue to enjoy a level of protection essentially equivalent to that guaranteed within the EU. Transfers are prohibited unless grounded on: 1. Adequacy decisions (Art. 45), 2. Appropriate safeguards (Art. 46, SCCs/BCRs), or 3. Strict statutory derogations (Art. 49).
| Transfer Instrument | Legal Mechanism | Compliance Burden |
|---|---|---|
| Adequacy Decision (Art. 45) | Formal Commission decision recognizing a third country's equivalent legal system. | Direct data flow without prior authorization or additional safeguards (e.g. UK, Japan, DPF). |
| Standard Contractual Clauses (Art. 46) | Commission-approved template clauses (Decision 2021/914) binding exporter and importer. | Mandatory Transfer Impact Assessment (TIA); implementation of supplemental technical measures. |
| Binding Corporate Rules (Art. 47) | Legally binding internal codes approved by competent DPAs for multinational groups. | Substantial multi-year drafting and supervisory review process for intra-group data flows. |
| Derogations (Art. 49) | Explicit consent, contract performance, legal claims, vital interests. | Strictly confined to occasional, non-systematic transfers; cannot justify regular business ops. |