Transfers of Personal Data Outside the EU: What IT Companies Should Check
International transfers of personal data do not arise only when a database is hosted on a foreign server. Access by a foreign support team, the use of cloud infrastructure, or the storage of backups in another region may also fall under the rules of Chapter V of the GDPR.
Such operations are not prohibited, but the company must ensure that the European level of protection is maintained after the information is transferred to a third country. To do this, it is necessary to identify all recipients, select an appropriate legal transfer mechanism, and assess whether it can operate effectively in light of local law.
What Is Considered a Transfer of Data Outside the EU
In practice, international transfer rules apply to transfers of data outside the European Economic Area. In addition to EU Member States, the EEA includes Norway, Iceland, and Liechtenstein.
A transfer occurs when an organization subject to the GDPR sends or makes personal data available to another organization in a third country.
The information does not necessarily have to physically move to a foreign server. Remote access may also be considered a transfer. For example, if a database is hosted in Frankfurt but support specialists in another country can view user accounts, such access must be analyzed separately.
International data flows often arise when using:
- cloud hosting;
- CRM and email services;
- analytics and advertising platforms;
- technical support systems;
- development and monitoring tools;
- backup services;
- contractors from other countries.
Therefore, the review should cover not only the primary provider but the entire technical chain of the product.
Why an EU Server Is Not Enough
Configuring Data Residency in the EU does not always mean that data never leaves the European Economic Area.
The primary database may be stored in a European data center, while diagnostic logs, backups, or support requests may be processed in other regions. A provider’s foreign team may also have administrative access to the infrastructure.
When selecting a service, it is important to check:
- where the primary database and backups are located;
- from which countries technical access is possible;
- where event logs are transferred;
- which contractors are involved in support;
- whether access can be restricted by region;
- which settings depend on the selected service plan.
Information on a provider’s marketing page may differ from the contractual terms and the actual architecture. Therefore, conclusions should be based on the DPA, the list of subprocessors, the security documentation, and the settings of the specific account.
What Legal Mechanisms Can Be Used to Transfer Data
Adequacy Decision
The European Commission may determine that a particular country provides an adequate level of personal data protection. Transfers to such a jurisdiction do not require the additional safeguards provided for under Article 46 of the GDPR.
A decision may apply to an entire country, a specific sector, or only organizations with a particular status. For example, when transferring data to the United States, it is necessary to verify not only the existence of the relevant adequacy decision but also the specific recipient’s participation in the applicable framework.
The list of adequate jurisdictions and the recipient’s status should be checked immediately before the transfer begins. Decisions may be reviewed, and a company’s certification may lapse.
Standard Contractual Clauses
If there is no adequacy decision, Standard Contractual Clauses, or SCCs, are most commonly used. These are contractual terms approved by the European Commission between the data exporter and the data importer.
SCCs provide for different modules depending on the roles of the parties. Therefore, before entering into them, it is necessary to determine who is the controller and who is the processor.
The annexes to the SCCs describe:
- the purposes and frequency of the transfer;
- the categories of personal data;
- the categories of data subjects;
- retention periods;
- recipients and subprocessors;
- technical and organizational security measures.
Simply signing a standard template is not sufficient. The annexes must reflect the actual transfer, and the parties must comply with their obligations in practice.
Binding Corporate Rules
Large international groups may use Binding Corporate Rules. They govern transfers of personal data between affiliated companies and require approval by a European supervisory authority.
For an individual IT company, this mechanism is generally more complex than SCCs, but it may be convenient for a group with a large number of regular data flows between different countries.
Article 49 Derogations
In certain situations, a transfer may be based on the individual’s explicit consent, the necessity of performing a contract, or another derogation provided for under Article 49 of the GDPR.
Such grounds are not intended for ongoing operations. For example, the regular use of a foreign cloud service should not be justified solely by user consent. A systematic data flow requires a sustainable transfer mechanism.
What Is a Transfer Impact Assessment
If a transfer is based on SCCs or another Article 46 mechanism, the company must assess whether the recipient will actually be able to comply with the safeguards provided. This assessment is commonly documented as a Transfer Impact Assessment, or TIA.
The assessment analyzes not only the wording of the agreement but also the laws of the recipient country. Particular attention is paid to the possibility of public authorities accessing the data and the availability of effective means for protecting users’ rights.
A TIA should take into account the specific transfer:
What data is transferred. The risks will differ for ordinary contact details, financial information, geolocation data, and health data.
Who the recipient is. Its activities, technical role, experience in handling government requests, and ability to disclose information are assessed.
Whether the recipient can read the data. If the information is securely encrypted and the keys remain in the EEA, the risk may be lower. Encryption does not help if the foreign service needs access to the data in unencrypted form.
How the transfer is structured. The frequency, volume, number of users, and onward movement of the information are relevant.
What safeguards are already in place. Contractual obligations, internal procedures, certifications, and technical measures are reviewed.
The assessment should lead to a practical conclusion: whether the selected structure provides a level of protection comparable to the European standard. If it does not, the transfer must be modified, supplemented with additional safeguards, or discontinued.
What Additional Measures May Be Required
Additional measures are selected based on the results of the TIA. They may be technical, contractual, or organizational.
Technical measures include encryption, pseudonymization, minimization of the information transferred, separation of databases, and restrictions on administrative access. It is important to consider not only the algorithm used but also who holds the encryption keys.
Organizational measures include separating employee access rights, logging activities, regularly reviewing access permissions, and establishing procedures for handling requests from public authorities.
The agreement may require the recipient to verify the lawfulness of requests, challenge them where there are grounds to do so, and notify the exporter. However, contractual commitments do not replace technical safeguards if local law effectively requires the recipient to disclose data available to it.
How to Review Onward Transfers
Even if the primary provider is located in the EU, it may engage companies in third countries. Therefore, it is necessary to review not only the initial transfer but also the subsequent movement of information.
For each foreign recipient, it is necessary to determine:
- Where it is located and from where it accesses the data.
- Which categories of information it processes.
- Which mechanism the transfer is based on.
- Which security measures are applied.
- To whom it may transfer the data further.
- How the company will be informed of changes in the processing chain.
It is particularly important to monitor updates to the list of subprocessors. A new contractor may change the geography of processing and require a review of the TIA and contractual safeguards.
How to Conduct an Audit of International Data Transfers
Map Data Flows
It is necessary to identify which systems the company uses, what information enters them, and where the providers are located. The production environment, backups, analytics, support, and internal tools should all be taken into account.
Identify Foreign Access
The review should cover not only storage but also the possibility of remote access. Group employees, external developers, support teams, and technical contractors should be included in the map.
Determine the Transfer Mechanism
For each recipient, it is necessary to determine whether an adequacy decision, SCCs, BCRs, or an applicable derogation is available. The legal mechanism must correspond to the nature and frequency of the operation.
Conduct a TIA
If SCCs or another Article 46 mechanism are used, the laws of the country, the recipient’s circumstances, and the actual risks of access should be assessed.
Update the Documentation
The results should be reflected in the SCCs, records of processing activities, descriptions of security measures, and the company’s internal documentation. Users should be provided with accurate information about international transfers and the safeguards applied.
Common Mistakes IT Companies Make
Checking only the data center. Access by foreign support teams may also constitute a transfer.
Signing SCCs without conducting an assessment. Standard contractual terms do not eliminate the need to analyze the recipient country and the specific data flow.
Using consent for regular processing. Derogations should not become the basis for permanent infrastructure.
Ignoring onward transfers. The primary provider may engage foreign companies and change the processing chain.
Failing to review the TIA. Architecture, contractors, and legislation change, so the assessment should be periodically updated.
How Wolja Digital Can Help
Wolja Digital helps IT companies identify and properly structure transfers of personal data outside the EU.
We map international data flows, review foreign services and onward transfers, determine the appropriate transfer mechanism, and conduct a Transfer Impact Assessment.
Based on the results, we prepare SCCs, document additional safeguards, and bring the company’s documentation into line with the actual architecture of the product.