GDPR Chapter 5 – International Transfers

GDPR Chapter 5 – International Data Transfers

GDPR recognises that personal data transferred outside the UK may not be subjected to the same legal standards. As such, GDPR Chapter 5 (GDPR Articles 44 to 50) provide safeguards to protect that data.

From a practical perspective, transfers must be restricted to where the recipient (for the UK-US Data Bridge) or the recipient’s country (EU plus a few countries) has been deemed adequate, or a contract safeguard has been agreed between the parties.

What does GDPR Chapter 5 Say?

Extracting the pertinent sections:

GDPR Article 44 – General principle for transfers

Any transfer of personal data which are undergoing processing or are intended for processing after transfer to a third country or to an international organisation shall take place only if, subject to the other provisions of this Regulation, the conditions laid down in this Chapter are complied with by the controller and processor, including for onward transfers of personal data from the third country or an international organisation to another third country or to another international organisation. All provisions in this Chapter shall be applied in order to ensure that the level of protection of natural persons guaranteed by this Regulation is not undermined.

Article 45 – Transfers on the basis of an adequacy decision

  1. A transfer of personal data to a third country or an international organisation may take place where the Commission has decided that the third country, a territory or one or more specified sectors within that third country, or the international organisation in question ensures an adequate level of protection. Such a transfer shall not require any specific authorisation.
  2. <>
  3. The Commission, after assessing the adequacy of the level of protection, may decide, by means of implementing act, that a third country, a territory or one or more specified sectors within a third country, or an international organisation ensures an adequate level of protection within the meaning of paragraph 2 of this Article. The implementing act shall provide for a mechanism for a periodic review, at least every four years, which shall take into account all relevant developments in the third country or international organisation. The implementing act shall specify its territorial and sectoral application and, where applicable, identify the supervisory authority or authorities referred to in point (b) of paragraph 2 of this Article. The implementing act shall be adopted in accordance with the examination procedure referred to in Article 93(2).
  4. <>

Article 46 – Transfers subject to appropriate safeguards

  1. In the absence of a decision pursuant to Article 45(3), a controller or processor may transfer personal data to a third country or an international organisation only if the controller or processor has provided appropriate safeguards, and on condition that enforceable data subject rights and effective legal remedies for data subjects are available.
  2. <>
  3. Subject to the authorisation from the competent supervisory authority, the appropriate safeguards referred to in paragraph 1 may also be provided for, in particular, by:

(a) contractual clauses between the controller or processor and the controller, processor or the recipient of the personal data in the third country or international organisation; or

(b) <>. 4. <>

How Do We Comply With GDPR Chapter 5 For Data Transfers?

Before transferring data to be processed (accessed, viewed, used, stored, edited, etc) outside the UK, you should ensure one of:

  1. Data is being transferred to an “adequate” country, which are currently (2025) this strange list of countries:

    • Andorra,
    • Argentina,
    • Canada (for commercial organizations),
    • Faroe Islands,
    • Guernsey,
    • Israel,
    • Isle of Man,
    • Japan,
    • Jersey,
    • New Zealand,
    • the Republic of Korea,
    • Switzerland,
    • the United States (for commercial organisations certified under the UK-US Data Privacy Framework),
    • Uruguay

  2. There is a contractual extension between the sending and receiving party, as either the:

    • International Data Transfer Agreement (IDTA) or
    • EU Standard Contractual Clauses with UK Addendum.