Article 44 of the GDPR: Data Transfers to Third Countries

01 août 2025 · By Bertrand Bucelle · 2 min read

Article 44 of the GDPR Explained

Any transfer of data to a third country or an international organisation may only take place if:

The third country offers an adequate level of protection, recognised by a decision of the European Commission;
Or if appropriate safeguards have been put in place (standard contractual clauses, binding corporate rules, etc.);
Or if specific derogations apply in limited cases (e.g., explicit consent, performance of a contract, public interest grounds, etc.).

Why This Article is Important for Your GDPR Compliance

Data transfers to third countries represent a high risk to privacy if safeguards are insufficient. Article 44 makes it possible to ensure the continued protection of personal data, even outside the EU.

How to Comply with Article 44 of the GDPR?

Identify all data transfers outside the EU carried out by your organisation;
Verify if an adequacy decision exists for the destination country;
If this is not the case, implement appropriate safeguards (Standard Contractual Clauses, BCRs...);
Document the measures taken and inform the data subjects.

GDPR Article 44 Application Examples

A European company uses an American cloud service: it implements the standard contractual clauses approved by the European Commission;
A French company transfers data to its Japanese subsidiary: Japan benefits from an adequacy decision;
An association sends data to an NGO in a country without an adequate framework: it obtains explicit consent.

Related Resources

Accelerate your compliance in a few clicks

Thanks to our all-in-one solution, you can easily accelerate and ensure your compliance:

Automate your compliance with our GDPR software
Supported or outsourced by our DPO experts
Raise your teams' awareness with our GDPR e-learning training

Request a demo with an expert

Assess your situation in 15 minutes with our free, no-obligation GDPR self-assessment.

GDPR: Self-assess now