DPL Consult Data Protection Agency

International data protection: What do companies have to consider when transferring data internationally?

Data processing is international: in our internationally networked world, personal data is relevant to everyone. Export and import companies that also operate outside Germany therefore need expert advice that keeps track of the complex international data world. Generally speaking, anyone who conducts business inside and outside the European Union (EU) or the European Economic Area (EEA), must ensure that the European level of data protection also applies in the so-called third countries that do not belong to the EU or the EEA

The General Data Protection Regulation allows the transfer of personal data to third countries under certain conditions. Thus, a data transfer to so-called safe third countries is permitted. In particular, these are countries for which the European Commission has adopted a so-called adequacy decision. These countries must have legal regulations that guarantee a level of data protection equivalent to that in the EU.

Which third countries are considered safe?

For the following third countries, for example, the EU Commission has adopted adequacy decisions so that data transfers to these countries are considered secure:

  • Argentina
  • Canada (commercial organisations only)
  • Israel
  • New Zealand
  • Switzerland
  • South Korea
  • Japan
  • United Kingdom
  • USA (to certified companies)

A transfer of personal data to third countries without an adequacy decision, on the other hand, is only permissible under further conditions. 

This includes the prior precise analysis of the level of data protection in the respective third country as well as the conclusion of data protection contracts with the data recipients in the third country to ensure that the protection of the personal data transferred is guaranteed. The European Commission has provided so-called standard contractual clauses for this purpose. We advise you on the determination of the level of data protection in the third country and on the drafting of the standard contractual clauses that enable you to transfer personal data to third countries without an adequacy decision. 

Get In Touch.

Temporibus autem quibusdam et aut officiis debitis aut rerum necessitatibus saepe eveniet ut et voluptates repudiandae sint et molestiae non recusandae.