International transfers of personal data

Overview

Under the General Data Protection Regulation (GDPR) your personal data can only be transferred to a third country in certain circumstances.  A third country means a country outside of the European Economic Area (EEA).  The EEA is made up of 28 EU Member States as well as Norway, Iceland and Liechtenstein. Examples of how personal data can be transferred are:

  • if the European Commission considers the third country to have an adequate level of data protection (adequacy decision)
  • if the transfer of personal data is required or authorised by law.

Next: Legal instruments for transfer of personal data