Chapter 5. Transfers of Personal Data to Third Countries or International Organisations (Articles 44-50)

Provides the rules for transferring personal data that is undergoing or will undergo processing outside of the Union.

Article 44 – General principle for transfers

Controllers and processors can only transfer personal data if they comply with the conditions in this chapter.

Article 45 – Transfers on the basis of an adequacy decision

A transfer of personal data to a third country or international organization can occur if the Commission has decided the country or organization can ensure an adequate level of protection.

Article 46 – Transfers subject to appropriate safeguards

If the Commission has decided it can’t ensure an adequate level of protection, a controller or processor can transfer personal data to a third country or organization if it has provided appropriate safeguards.

Article 47 – Binding corporate rules

The supervisory authority will approve binding corporate rules in accordance with the consistency mechanism in Article 63.

Article 48 – Transfers or disclosures not authorised by Union law

Any decision by a court or administrative authority in a third country to transfer or disclose personal data is only enforceable if the decision is based on an international agreement.

Article 49 – Derogations for specific situations

If there is no adequacy decision (Article 45) or appropriate safegaurds, a transfer of personal data to a third country or organization can only happen if one of seven certain conditions are met.

Article 50 – International cooperation for the protection of personal data

The Commission and supervisory authority have to do their best to further cooperation with third countries and international organizations.

References

• GDPR Home

• GDPR Chapters

• GDPR Recitals

• GDPR Key Issues