Skip to content
SimpleAct Logo

Guide · GDPR Art. 44–49

As of 4 October 2026

International Data Transfers under the GDPR: Adequacy, SCCs, DPF and TIA

Cloud, support from India, an AI model in the US: as soon as personal data leaves the EEA – or is accessed from outside it – you need a basis under Chapter V GDPR. This guide gives you every transfer tool as a table, the current list of adequacy decisions, the six EDPB steps and a transfer check.

Check a transferTransfer tools at a glance
  • Every tool in Art. 45–49
  • List of adequacy decisions
  • 6 EDPB steps incl. TIA
  • Transfer check with RoPA text
app.simpleact.de

Third-country transfers

Demo Organisation Ltd · 4 recipients

A
  • AI model API · USADPF (certified) · TIA not required
  • Support provider · IndiaSCC (module 2) · TIA in progress
  • Ticket tool · SwitzerlandAdequacy · TIA not required
  • Analytics service · unknownunclear · TIA pending

Sample data · remote access counts as a transfer

In short

Transferring personal data to a country outside the EEA is only lawful if the Commission has adopted an adequacy decision (Art. 45), appropriate safeguards such as standard contractual clauses are in place (Art. 46) or a derogation for a specific situation applies (Art. 49). With standard contractual clauses you must also assess whether they are effective in the destination country.

Basics

What an international transfer is – and why it needs a basis of its own

Within the EU and the European Economic Area (EEA – the EU plus Norway, Iceland and Liechtenstein), the GDPR applies uniformly. When data leaves this area, the level of protection should travel with it. That is why Chapter V GDPR requires a basis of its own for every transfer to a third country or international organisation – in addition to the legal basis for the processing under Art. 6 (Art. 44). This also applies to onward transfers from the third country to another country.

A transfer does not only happen when data is physically copied. According to Recommendations 01/2020 of the European Data Protection Board (EDPB), remote access by an entity in a third country to data located in the EEA is also a transfer – for example by a provider's support or administration teams. For cloud and AI services, looking at the server location is therefore not enough.

The GDPR has three levels. First choice is an adequacy decision by the European Commission under Art. 45: transfers to the recognised countries are treated like transfers within the EU and need no specific authorisation. Where there is none, appropriate safeguards under Art. 46 are needed – in practice usually the Commission's standard contractual clauses (SCCs) from Implementing Decision (EU) 2021/914 or, within a group, binding corporate rules (BCRs) under Art. 47. Only where both are missing do the derogations for specific situations in Art. 49 come into play.

For the US, the adequacy decision on the EU-US Data Privacy Framework (Implementing Decision (EU) 2023/1795) has applied since 10 July 2023. It only covers companies certified under the framework. Whether a provider is certified can be checked in the official list of the US Department of Commerce. If it is not, you still need standard contractual clauses or another basis for transfers to the US.

Standard contractual clauses are not always enough on their own. In its judgment of 16 July 2020 (C-311/18, "Schrems II"), the Court of Justice of the EU ruled that safeguards under Art. 46 must actually ensure an essentially equivalent level of protection in the destination country. The EDPB has described six steps for this: know your transfers, identify the tool, assess its effectiveness in the destination country, adopt supplementary measures, take procedural steps, re-evaluate regularly. The assessment in step 3 is often called a transfer impact assessment (TIA) in practice.

The derogations in Art. 49 – such as explicit consent after being informed of the risks, the performance of a contract with the data subject or legal claims – are meant for specific situations. For regular transfers, such as the ongoing operation of a cloud service, they are generally not a viable basis. If you use them, document them in your record of processing.

Infringements of Art. 44–49 fall into the higher fine tier: Art. 83(5)(c) provides for up to EUR 20 million or 4% of worldwide annual turnover, whichever is higher. Information duties apply too: privacy notices must state an intended transfer and the safeguards (Art. 13(1)(f)), and the record of processing lists third countries separately (Art. 30(1)(e)).

levels: adequacy (Art. 45), safeguards (Art. 46), derogations (Art. 49)
3
levels: adequacy (Art. 45), safeguards (Art. 46), derogations (Art. 49)
steps under EDPB Recommendations 01/2020
6
steps under EDPB Recommendations 01/2020
or 4% of turnover: fine ceiling for breaches of Art. 44–49 (Art. 83(5))
€20m
or 4% of turnover: fine ceiling for breaches of Art. 44–49 (Art. 83(5))

Transfer tools

Transfer tools under Chapter V GDPR at a glance

Check in this order: adequacy first, then safeguards, derogations last. The right-hand column shows whether an assessment of the destination country under the EDPB recommendations is needed.

Adequacy decision
When it fitsDestination country, territory, sector or organisation is recognised by the Commission
Destination assessment (TIA)?No
NoteNo specific authorisation needed; observe the scope of the decision
ReferenceArt. 45
EU-US Data Privacy Framework
When it fitsUS recipient is certified under the DPF
Destination assessment (TIA)?No
NoteCheck and document the certification in the official DPF list
ReferenceArt. 45; ID (EU) 2023/1795
Standard contractual clauses (SCCs)
When it fitsNo adequacy decision; contract with the recipient
Destination assessment (TIA)?Yes
NoteChoose the right module; supplementary measures where needed
ReferenceArt. 46(2)(c); ID (EU) 2021/914
Binding corporate rules (BCRs)
When it fitsTransfers within a group of undertakings
Destination assessment (TIA)?Yes
NoteApproval by the supervisory authority required
ReferenceArt. 46(2)(b); Art. 47
Codes of conduct, certification
When it fitsApproved codes or certifications with binding commitments of the recipient
Destination assessment (TIA)?Yes
NoteRare in practice
ReferenceArt. 46(2)(e), (f)
Ad hoc contractual clauses
When it fitsOwn clauses instead of SCCs
Destination assessment (TIA)?Yes
NoteApproval by the supervisory authority required
ReferenceArt. 46(3)(a)
Explicit consent
When it fitsSpecific situation, person informed of the risks
Destination assessment (TIA)?Not applicable
NoteNot a permanent solution; can be withdrawn at any time
ReferenceArt. 49(1)(a)
Performance of a contract
When it fitsTransfer is necessary for a contract with or in the interest of the person
Destination assessment (TIA)?Not applicable
NoteOnly as far as necessary, e.g. a hotel booking abroad
ReferenceArt. 49(1)(b), (c)
Legal claims, vital interests
When it fitsEstablishing or defending claims; protecting life
Destination assessment (TIA)?Not applicable
NoteTo be interpreted narrowly
ReferenceArt. 49(1)(e), (f)
Compelling legitimate interests
When it fitsNot repetitive, limited number of data subjects, only as a last resort
Destination assessment (TIA)?Not applicable
NoteInform the supervisory authority and data subjects; document in the RoPA (Art. 49(6))
ReferenceArt. 49(1), 2nd subpara.

Judgments or decisions of third-country authorities requiring disclosure may only be recognised on the basis of an international agreement such as a mutual legal assistance treaty (Art. 48).

Interactive

Transfer check: which basis do you need?

Answer up to four questions about one recipient. You see which basis under Chapter V may apply, whether an assessment of the destination country is needed, what to do – and a text for your record of processing (Art. 30(1)(e)). Nothing is stored or transmitted.

1 · Where is the recipient – or where does it access the data from?
app.simpleact.de

Result

–

A

Answer the questions to see the matching basis.

A working aid for orientation, not legal advice. The destination assessment and the choice of basis depend on the specific case.

Adequacy

Which countries an adequacy decision covers

Before adopting an adequacy decision, the Commission assesses among other things the rule of law, public authorities' access to data, independent supervision and remedies in the destination country (Art. 45(2)). Once a decision is in place, data may flow from the EU – and from Norway, Iceland and Liechtenstein – without further safeguards.

Some decisions are limited: for Canada only to commercial organisations, for the US only to companies participating in the Data Privacy Framework. The Commission reviews the decisions periodically; they can be amended or withdrawn. Check the current status on the Commission's page before every new transfer.

An adequacy decision does not replace the other obligations. Even for a transfer to a recognised country you need a legal basis under Art. 6, a data processing agreement under Art. 28 for service providers, and the transfer belongs in the record of processing and the privacy notice. If data moves on from the recognised country to another third country, that onward transfer must be covered too (Art. 44).

  • Andorra
  • Argentina
  • Brazil
  • Canada (commercial organisations)
  • Faroe Islands
  • Guernsey
  • Isle of Man
  • Israel
  • Japan
  • Jersey
  • New Zealand
  • Republic of Korea
  • Switzerland
  • United Kingdom
  • United States (DPF-certified companies only)
  • Uruguay
  • European Patent Organisation
According to the European Commission's overview, retrieved on 4 October 2026

EDPB Recommendations 01/2020

The six steps for transfers based on SCCs or BCRs

After Schrems II, the EDPB describes how controllers and processors assess whether an Art. 46 tool is effective in the destination country. The right-hand column shows what that means in practice for an AI service – that is our recommendation.

1. Know your transfers
What to doRecord all transfers, including onward transfers and remote access; check data minimisation
For an AI serviceRecord model providers, data centres, the vendor's support and moderation teams
2. Identify the transfer tool
What to doAdequacy decision? Otherwise a tool under Art. 46; Art. 49 derogations only in specific situations
For an AI serviceCheck DPF certification; otherwise SCCs in the vendor's DPA
3. Assess effectiveness in the destination
What to doAssess law and practice of the destination, in particular public authority access (often called "TIA")
For an AI serviceWhich laws allow access to inputs and logs? Are there transparency reports?
4. Supplementary measures
What to doTechnical, contractual and organisational measures where the tool alone is not enough
For an AI serviceEncryption, pseudonymised inputs, EU data region, no training, short retention
5. Procedural steps
What to doFormal steps for the chosen tool, e.g. adopting SCCs unchanged
For an AI serviceChoose the correct SCC module, complete the annexes
6. Re-evaluate regularly
What to doMonitor developments in the destination country and at the recipient
For an AI serviceNew sub-processors, new regions, changes in the law

Source: EDPB Recommendations 01/2020 on measures that supplement transfer tools, version 2.0 of 18 June 2021.

Practice

Typical scenarios and how they are classified

This is how common cases in mid-sized companies are typically classified. It is a guide – what counts are the contract, the actual data flows and the current status of the decisions.

US cloud provider with DPF certification
Typical basisAdequacy decision (EU) 2023/1795
What to checkCertification in the DPF list, scope of the certification, sub-processors outside the US
US provider without DPF certification
Typical basisStandard contractual clauses (Art. 46(2)(c))
What to checkRight SCC module in the DPA, destination assessment, supplementary measures such as encryption
Provider with an EU data centre, support from a third country
Typical basisDepending on the support country: adequacy or SCCs
What to checkWho accesses from where? Remote access is a transfer (EDPB)
Group company outside the EU
Typical basisBCRs or SCCs; adequacy of the country where applicable
What to checkIntra-group agreement, roles (controller or processor), onward transfers
Service provider in the United Kingdom or Switzerland
Typical basisAdequacy decision
What to checkCheck the current status of the decision on the Commission's page
AI model API via an EU reseller
Typical basisDepends on the chain: reseller in the EU, model provider possibly in a third country
What to checkReseller's sub-processor list, data region, basis for the onward transfer
Single email to a business partner in a third country
Typical basisDepending on content: contract performance (Art. 49(1)(b), (c)) or no personal data
What to checkWhether personal data is included and whether it really is a one-off
Hotel booking for staff abroad
Typical basisArt. 49(1)(b) or (c) (contract performance)
What to checkOnly transfer the data needed for the booking

In every scenario: document the outcome and basis in the RoPA and mention it in the privacy notice.

Transfers and AI

AI services and international transfers: what to watch

Many large model providers operate their services wholly or partly outside the EU. These points are our review recommendation for AI services.

01

Not just the server location

An EU data centre does not rule out transfers: support, security or moderation teams in a third country with access to inputs are a transfer according to the EDPB.

02

Look at the whole chain

Behind an AI tool there is often a model provider and a cloud data centre. Every onward transfer needs a basis (Art. 44, first sentence).

03

Check DPF certification

For US providers, check the DPF list first – and document it with a date. Without certification, SCCs and the destination assessment remain.

04

Data region as a setting

Many providers offer an EU data region. Document the setting as part of your instructions in the DPA – and check what it actually covers.

05

Minimise data

What is not transferred needs no basis. Pseudonymised or shortened inputs reduce the risk and make the destination assessment easier.

06

Make it visible in the RoPA

The third country and basis belong in the RoPA entry of the processing that uses the AI tool (Art. 30(1)(e)) and in the privacy notice (Art. 13(1)(f)).

The AI Act does not change Chapter V GDPR. It may require providers established outside the EU to appoint an authorised representative in the EU – that does not replace a transfer basis.

Approach

Getting international transfers under control in 6 steps

How to bring order into your transfers. The order is a recommendation from practice and follows the EDPB steps.

  1. 1

    Record recipients

    From the RoPA, vendor list and DPAs, identify every recipient located or accessing data outside the EEA – including sub-processors.

  2. 2

    Assign a basis

    Per transfer: adequacy, DPF, SCCs, BCRs or a derogation. "Unknown" is a to-do, not a result.

  3. 3

    Assess the destination

    For SCCs and BCRs, carry out and document the assessment under EDPB step 3.

  4. 4

    Define measures

    Where needed, agree supplementary technical and organisational measures – or change provider.

  5. 5

    Document and inform

    Update the RoPA (Art. 30(1)(e)) and privacy notices (Art. 13(1)(f)).

  6. 6

    Re-evaluate

    Check again with new sub-processors, regions or legal changes. We also recommend a yearly review.

Common mistakes

Six mistakes with international transfers

"Servers in the EU" as a free pass

Remote access from third countries is also a transfer. Ask about support and admin locations.

DPF assumed, not checked

The DPF only covers certified companies. Without checking the list, the assumption is a guess.

SCCs without destination assessment

Since Schrems II, signing SCCs is not enough on its own. The assessment under EDPB step 3 is part of it.

Art. 49 as a permanent solution

Consent or contract performance do not support ongoing, systematic transfers by a cloud service.

Onward transfers forgotten

The direct provider is in the EU, its sub-processor is not? That is also a transfer.

Missing from RoPA and notices

Third countries and safeguards belong in the record of processing and the privacy notice.

With SimpleAct

International transfers in SimpleAct

In the GDPR module (from Professional) the record of processing flags third-country transfers with their safeguards. The transfer register with assessment status is part of the Enterprise plan.

  • RoPA entry with third-country transfer flag and safeguards
  • Processors linked from the vendor register
  • Transfer register (Enterprise): recipient, destination, basis
  • SCC version and destination assessment status with date
  • Linked to the vendor and the RoPA entry

And SimpleAct itself?

Platform data is stored in Germany (Hetzner, Nuremberg; backups in Falkenstein). Sub-processors are Hetzner, Stripe (payments), Brevo (email) and Anthropic (AI assistant, only if switched on; the texts submitted to it are also processed in the USA) – details are in our DPA.

See SimpleAct's DPA

FAQ

Frequently asked questions about international transfers

Any country outside the European Economic Area, i.e. outside the EU and Norway, Iceland and Liechtenstein. Transfers there are governed by Chapter V GDPR (Art. 44–49).
Yes. According to EDPB Recommendations 01/2020, remote access by an entity in a third country to data located in the EEA is also considered a transfer – for example by a service provider's support or administration teams.
According to the European Commission's overview (as of 4 October 2026): Andorra, Argentina, Brazil, Canada (commercial organisations), the Faroe Islands, Guernsey, Israel, the Isle of Man, Japan, Jersey, New Zealand, the Republic of Korea, Switzerland, the United Kingdom, the United States (DPF-certified companies only), Uruguay and the European Patent Organisation.
Yes, with a basis. For companies certified under the EU-US Data Privacy Framework, adequacy decision (EU) 2023/1795 of 10 July 2023 applies. For non-certified recipients you need standard contractual clauses with a destination assessment, or another basis.
Contract clauses adopted by the Commission under Art. 46(2)(c) GDPR, currently from Implementing Decision (EU) 2021/914. They are agreed with the recipient and have modules for the different roles of exporter and importer. Their content must not be changed.
The assessment of whether an Art. 46 tool – such as SCCs – actually ensures an essentially equivalent level of protection in the destination country. It follows from the CJEU's Schrems II judgment (C-311/18) and corresponds to step 3 of EDPB Recommendations 01/2020. The outcome must be documented.
Only in specific situations: the person must explicitly consent after being informed of the risks of a transfer without an adequacy decision and without safeguards (Art. 49(1)(a)). For ongoing, systematic transfers this is generally not a viable basis.
Yes. Art. 30(1)(e) requires transfers to third countries, naming the country and, for transfers under the second subparagraph of Art. 49(1), documentation of the safeguards. Privacy notices must also mention the transfer (Art. 13(1)(f)).
Infringements of Art. 44–49 can be fined under Art. 83(5)(c) GDPR with up to EUR 20 million or 4% of worldwide annual turnover, whichever is higher. The supervisory authority can also order the suspension of transfers.
Large providers usually incorporate the SCCs into their DPA or terms; accepting those agrees to them. Check which module applies and whether the annexes – data categories, purposes, security measures – match your use.
No. The Commission reviews decisions periodically and can amend or withdraw them; the Court of Justice can also declare them invalid, as happened to the predecessors of the Data Privacy Framework. Check the status regularly and keep an alternative ready for important transfers.
Nothing in the GDPR rules. Art. 44–49 apply to AI services like to any other service. Because many model providers are located outside the EU or have access from there, the assessment is especially often needed for AI tools.

More questions? We're happy to help. Send email · Try 7 days (credit card required)

Sources and status

As of · SimpleAct editorial team

This guide is general information and not legal advice. Adequacy decisions can change; the Commission's current status is authoritative.

Changes

  • 2026-10-04 – Page rebuilt: transfer tools table, list of adequacy decisions, six EDPB steps, transfer check with RoPA text, AI section.
  • 2026-06-13 – First version.

Related topics

Every international transfer with a basis and status

SimpleAct connects vendors, the record of processing and the transfer register. Try 7 days (credit card required) or book a demo.

Book a demoTry 7 days (credit card required)