Lesson 5.33: International data transfers
GDPR Chapter V allows personal data to leave the EU only with a transfer mechanism: an adequacy decision for the destination, appropriate safeguards such as the Standard Contractual Clauses (the current set adopted in June 2021), or narrow exceptions. For the United States, the EU–US Data Privacy Framework adequacy decision of 10 July 2023 covers transfers to companies certified under it. With SCCs, a transfer impact assessment checks whether the destination's laws let the clauses work in practice. In the lab you read Northwind's vendor register, find a transfer with no mechanism, check certifications, catch outdated clauses and missing assessments, and record actions.
18 min
You will learn to
- Explain when a transfer mechanism is needed
- Tell adequacy, DPF and SCCs apart
- Find transfers with no mechanism
- Check DPF certification and SCC versions
- Spot missing transfer impact assessments
Key terms
- Adequacy decision
- A European Commission decision that a country protects data essentially as well as the EU.
- Data Privacy Framework (DPF)
- EU–US framework with an adequacy decision of 10 July 2023, covering certified US companies.
- Standard Contractual Clauses (SCCs)
- Commission-approved contract terms for transfers; current set adopted June 2021.
- Transfer impact assessment (TIA)
- An assessment of whether the destination's laws let the safeguards work in practice.
- Schrems II
- 2020 Court of Justice ruling that invalidated the Privacy Shield and required case-by-case checks for SCCs.
← Reading a security culture survey · All lessons · Key-person risk and succession →