According to the EDPB, a processing operation is a transfer under Chapter V of the GDPR when three things are all true: an exporter is subject to the GDPR for that processing, the exporter makes personal data available to an importer, and the importer is in a third country. If one is missing, it is not a transfer.
The three criteria
From the Board's Guidelines 05/2021 (version 2.0):
- A controller or a processor (the exporter) is subject to the GDPR for the given processing.
- The exporter discloses by transmission or otherwise makes the personal data available to another controller, joint controller or processor (the importer).
- The importer is in a third country, whether or not the importer is itself subject to the GDPR for that processing, or is an international organisation.
The Board stresses that whether the GDPR applies is judged per processing operation, not per company.
Why criterion two matters
Criterion two needs two separate parties. The guidelines give an example of an employee of an EU company travelling to a third country with a laptop and accessing company databases remotely. The Board says this does not qualify as a transfer, because the processing is carried out by the same controller and the employee is not a separate importer. That differs from a contractor or a vendor, who is a separate party.
Remote access by a vendor is different
The guidelines also give an example of a company in a third country with no EU establishment that acts as a processor for EU controllers and remotely accesses data stored in the EU, for example for support. Because that processor is located in a third country, the access results in a transfer from the EU controllers to the processor under Chapter V. Where the data is stored does not settle the question. See remote support access as a transfer.
A data subject is not an exporter
A person who sends their own data to a company abroad, for example by filling in an online form, is not an exporter. The EDPB makes this point in its recommendations on supplementary measures. The exporter is the controller or processor that makes the data available.
What to do with this
Use the three tests as a triage list when you review a new tool:
- Is the data about people in scope of the GDPR for this processing?
- Does a separate organisation receive or access it?
- Is that organisation, or its support staff, in a third country?
If all three are yes, record a transfer and pick a mechanism. The EDPB six step roadmap shows what follows.
Try it yourself
Click through it at your own pace, or open it full screen.
Click through the inventory and look at how many third party components a single application pulls in. Each one that processes personal data is a candidate for the three tests above.
Quick check
Is an employee on a business trip abroad a transfer?
Not by itself, according to the EDPB's example, because the same controller processes the data and there is no separate importer.
Does storing data in the EU mean there is no transfer?
No. Remote access from a third country by a separate organisation can be a transfer even when the data sits in the EU.
Sources
- EDPB Guidelines 05/2021 on the interplay between Article 3 and Chapter V (version 2.0)
- EDPB Recommendations 01/2020
This is educational content, not legal advice.
Last reviewed: 19 October 2026.
