How do you set up cross-border data transfers that protect privacy?

To set up cross-border transfers that protect privacy under the GDPR, map where personal data goes, then rely on an adequacy decision or an appropriate safeguard such as standard contractual clauses, assess the destination country's laws, and document the result. Keep the other GDPR duties in force after the data arrives.

This post explains the EU framework. It is not legal advice, and other countries have their own rules.

What counts as an international transfer?

The European Data Protection Board's guidance for small businesses says that when you transfer personal data, you still need an appropriate legal basis, security measures, and respect for principles like data minimization. If the recipient acts as a processor, you must still have a contract, just as for a processor inside the EEA. The transfer rules are added on top, not instead.

Start by finding your transfers. Look beyond the obvious database copy. A support tool hosted outside the EEA, a cloud region, an analytics service, a contractor with remote access: any of these may be a transfer.

What are your options?

Per the EDPB, there are in principle two main routes, plus limited exceptions.

1. Adequacy decision. The European Commission can formally confirm that a non-EEA country or international organization provides essentially equivalent protection. Transfers to such a country need no further safeguards, though the other GDPR principles still apply. Adequacy can cover a whole country, a region or a sector. The EDPB notes the Commission has adopted decisions for a list of countries and territories, including, for US commercial organizations, those participating in the EU-US Data Privacy Framework, and that exporters must monitor whether the decisions relevant to them stay in force.
2. Appropriate safeguards under Article 46. Where there is no adequacy decision, you may use tools such as standard contractual clauses, binding corporate rules, codes of conduct, certification mechanisms or ad hoc contractual clauses. Individuals must still be able to exercise rights and have effective legal remedies.
3. Derogations. The GDPR allows some in limited situations when neither of the above applies.

How do standard contractual clauses work?

On 4 June 2021, the European Commission issued modernized SCCs for transfers from controllers or processors in the EU or EEA to controllers or processors outside it. The EDPB says they cover several scenarios: controller to controller, controller to processor, processor to processor, and processor to controller. They allow more than two parties to join, give individuals the ability to invoke the clauses as third-party beneficiaries in most cases, set rules on liability, and oblige the parties to handle government access requests, including informing the exporter and challenging unlawful requests.

They also require a transfer impact assessment: a documented look at the specific circumstances of the transfer, the laws of the destination country, and the extra safeguards you put in place. The Commission also publishes questions and answers on using them.

Binding corporate rules suit multinational groups with many internal transfers. They are internal rules, binding on all group entities, that must confer enforceable rights on individuals and need approval from the competent authority.

What is a transfer impact assessment in practice?

Constructed example. A European software company uses a ticketing service hosted in a country with no adequacy decision. It signs the SCCs. Then it documents: what personal data enters tickets (names, email addresses, occasionally account details), who at the provider can access it, which local laws allow public authorities to demand it, what encryption and access controls apply, and what the provider will do if a demand arrives. If that assessment finds a gap, the company adds a safeguard, such as encryption with keys it controls or removing personal data from tickets, or it does not transfer.

What technical measures help?

Contracts are not enough alone. Practical controls that reduce exposure:

• Minimize: send only the fields the recipient needs.
• Encrypt in transit and at rest, and keep keys where you control them where possible.
• Pseudonymize identifiers before they leave.
• Limit access to named roles, and log it.
• Keep a record of processing that lists each transfer, its legal basis and the tool relied on.

How to check or apply this

1. List every system and vendor that processes personal data and where it runs and is supported from.
2. For each non-EEA recipient, find the route: adequacy decision, SCCs, binding corporate rules or another Art. 46 tool.
3. Sign the correct SCC module for the roles involved.
4. Run and document a transfer impact assessment for each.
5. Add technical safeguards where the assessment finds gaps.
6. Recheck adequacy decisions and vendor locations at least yearly.
7. Update your records of processing and privacy notices.

Quick check

Sources

• EDPB, SME guide: International data transfers
• European Commission, Standard Contractual Clauses (SCC)

Last reviewed: 18 October 2026.