Guide to Data Transfers outside the EU: how to achieve compliance?
·
Updated on ·
By 
Bertrand Bucelle · 6 min read
In brief
- A data transfer outside the EU occurs as soon as personal data is made accessible from a third country: a US cloud, overseas technical support, a subsidiary outside the Union. Achieving compliance means identifying these transfers and governing them through a valid mechanism, or risk illegality and some of the heaviest sanctions under the GDPR.
What is a transfer outside the EU?
A transfer of data outside the EU refers to any communication or making available of personal data to a country located outside the European Economic Area. The concept is broad: there is no need to physically 'move' the data — simple remote access from a third country is sufficient.
In practice, you transfer data outside the EU if you use a cloud service whose servers or support are located outside the Union, if a service provider accesses your data from abroad, or if you share data with a non-EU subsidiary. These situations are extremely common.
GDPR does not prohibit transfers, but strictly regulates them: they are lawful only if they rely on a valid mechanism guaranteeing a level of protection essentially equivalent to that of the EU.
Transfer mechanisms
GDPR provides a hierarchy of mechanisms. A valid one must be chosen for each transfer.
| Mechanism | When to use it |
|---|---|
| Adequacy decision | Country recognised by the Commission as providing adequate protection |
| Standard Contractual Clauses (SCCs) | Most common mechanism in the absence of an adequacy decision |
| Binding Corporate Rules (BCRs) | Intra-group transfers, following approval |
| Data Privacy Framework | To US companies certified under the EU-US framework |
| Derogations (Art. 49) | Specific and limited cases (explicit consent, contract) |
The derogations under Article 49 are interpreted strictly and cannot serve as the basis for large-scale or systematic transfers.
The legacy of Schrems II
The Schrems II ruling tightened the requirements: relying on a mechanism alone is not always sufficient — its effectiveness must be verified against the law of the destination country.
- SCCs remain valid, but their signature alone may be insufficient.
- A transfer impact assessment (TIA) evaluates the law and practices of the destination country.
- Supplementary measures (encryption, pseudonymisation, technical safeguards) may be required.
- The Data Privacy Framework was established to secure transfers to the United States.
The 'invisible' transfers you cannot miss
Most uncontrolled transfers originate from everyday tools. Identifying them is half the work.
- SaaS tools (CRM, messaging, analytics, support) hosted or operated outside the EU.
- Technical support or managed services provided from a third country.
- Subsidiaries, parent companies or service providers accessing data from abroad.
- Backups or cloud services whose actual location is outside the EU.
What penalties apply in the event of non-compliance?
Unlawful transfers fall under breaches of GDPR principles and are therefore subject to the highest penalty cap. European supervisory authorities are paying particularly close attention to this issue.
| Breach | Cap | Example |
|---|---|---|
| Transfer without a valid mechanism | €20M or 4% of global turnover | Non-EU cloud without SCCs or adequacy decision |
| Ineffective mechanism (Schrems II) | €20M or 4% of global turnover | SCCs without required supplementary measures |
| Failure to inform about transfers | €10M or 2% of global turnover | Incomplete privacy notice disclosures |
Common mistakes to avoid
- Overlooking "invisible" transfers carried out via common SaaS tools.
- Believing that simple remote access from abroad does not constitute a transfer.
- Signing SCCs without conducting the transfer impact assessment (TIA) required since Schrems II.
- Relying on the Article 49 derogations for regular or large-scale data flows.
- Failing to inform data subjects of the existence of transfers outside the EU.
- Not reassessing transfers even as the legal framework evolves rapidly.
How Data Comply One supports you
Data Comply One helps you map your transfers outside the EU — including invisible ones carried out via your SaaS tools — and link them to your processing register in a single platform.
Two modes are available: manage your transfers yourself using the software, or outsource them to our experts — an outsourced DPO — who qualify each data flow, secure the mechanisms (SCCs, Data Privacy Framework, BCRs), carry out transfer impact assessments and define supplementary measures, directly on the platform.
You thus master one of the most technical and closely scrutinised topics in GDPR, and maintain documentation ready to present, even as the legal framework evolves.
Where do you stand? ·
Take action
Take action with Data Comply One: all-in-one compliance software and outsourced DPO/CISO experts.
Discover the RGPD software →The RGPD regulation →
How to achieve compliance: the 6-step roadmap
Step 1 — Map your international data flows
Identify all transfers outside the EU, including remote access and SaaS tools. For each one, note the destination country, the data involved, and the service provider.
This mapping almost always reveals unsuspected transfers via common tools.
Step 2 — Qualify each transfer
For each flow, check whether an adequacy decision exists; if not, determine the appropriate mechanism (SCCs, DPF for the United States, intra-group BCRs).
Rule out Article 49 derogations for regular or large-scale transfers.
Step 3 — Put safeguards in place
Sign the standard contractual clauses or verify your US recipient's Data Privacy Framework certification. Incorporate these safeguards into your data processing agreements.
Ensure the version of the SCCs is up to date and supplemented with the required annexes.
Step 4 — Conduct a Transfer Impact Assessment (TIA)
Where the mechanism relies on safeguards (SCCs, BCRs), assess the law and practices of the destination country (government access, available remedies) and determine any supplementary measures required.
The TIA is the Schrems II requirement most frequently overlooked.
Step 5 — Apply supplementary measures
Where necessary, add technical and organisational measures: robust encryption, pseudonymisation, data segregation, access controls. These measures may be a condition for the lawfulness of the transfer.
These measures are designed to neutralise the risks identified by the TIA.
Step 6 — Document and inform
Link your transfers to the records of processing activities, inform data subjects in your privacy notices, and keep documentation ready for the supervisory authority. Re-evaluate whenever tools or applicable law change.
Transparency and traceability are essential: this area evolves rapidly.