Glossary
Third-country transfer / international data transfer
Data protection glossary · 1 minute read
A third-country transfer is the transfer of personal data to a recipient in a state outside the EU and the EEA or to an international organisation.
Two-stage test
First, the transfer as such must be lawful, meaning it must have a legal basis under Art. 6 GDPR. At the second stage, it must be checked whether the specific conditions of Arts. 44 et seq. GDPR are met.
Remote access from a third country, for example by a support service provider, also counts as a transfer.
Transfer tools
- adequacy decision of the European Commission
- standard contractual clauses
- binding corporate rules
- derogations for specific situations, for example explicit consent or performance of a contract
Since the Schrems II judgment, where standard contractual clauses are used, it must also be assessed whether the law of the recipient country undermines the protection (transfer impact assessment).
Legal provisions
- Arts. 44 to 46 GDPR
- Principles, adequacy decisions and appropriate safeguards.
- Art. 47 GDPR
- Binding corporate rules.
- Art. 49 GDPR
- Derogations for specific situations.
Related terms.
Third country In data protection law, a third country is any state outside the European Union and the European Economic Area. Art. 44 GDPR 
Standard contractual clauses (SCCs) Standard contractual clauses are model contracts issued by the European Commission that provide appropriate safeguards for transfers of personal data to third countries. Art. 46(2)(c) GDPR Schrems II Schrems II is the CJEU judgment of 16 July 2020 (C-311/18) which declared the EU-US Privacy Shield invalid. CJEU, C-311/18 Cloud computing Cloud computing is the provision of IT resources such as storage, computing power or software over the internet by an external provider. Art. 28 GDPR
All terms from A to Z Standard contractual clauses (SCCs) Standard contractual clauses are model contracts issued by the European Commission that provide appropriate safeguards for transfers of personal data to third countries. Art. 46(2)(c) GDPR Schrems II Schrems II is the CJEU judgment of 16 July 2020 (C-311/18) which declared the EU-US Privacy Shield invalid. CJEU, C-311/18 Cloud computing Cloud computing is the provision of IT resources such as storage, computing power or software over the internet by an external provider. Art. 28 GDPR 