International transfers

This subtopic discusses the international transfer of personal data under the EU’s General Data Protection Regulation, Regulation (EU) 2016/679 (the EU GDPR). For an introduction to the EU GDPR regime generally, including the data protection principles, terminology, territorial scope and applicability, see Practice Note: The EU’s General Data Protection Regulation (EU GDPR).

The Chapter V restrictions

Article 44 of Regulation (EU) 2016/679, EU GDPR prohibits controllers and processors subject to the EU GDPR from transferring personal data to any country or territory outside the EEA or to an ‘international organisation’ unless the conditions laid out in Chapter V (Transfers of personal data to third countries or international organisations) of the EU GDPR are complied with.

An international organisation under the EU GDPR means any organisation (and its subordinate bodies) governed by public international law or any other body which is set up by, or on the basis of, an agreement between two or more countries.

The transfer restrictions apply both to the initial transfer, and to any onward transfer.

For more information, see Practice Note: EU GDPR—transfers of personal data internationally and to

To view the latest version of this document and thousands of others like it, sign-in with LexisNexis or register for a free trial.

TAKE A FREE TRIAL

Latest EU Law News

EPC seeks service provider for VoP scheme test environment

The European Payments Council (EPC) has launched a request for proposal (RFP) for the selection of a technology service provider in charge of providing, operating and supporting a test environment for the validation and self-certification of the verification of payee (VOP) API (both server-side and client-side) by the scheme participants. Responses are sought by 17 January 2025.

Commission finalises comprehensive EU-Switzerland agreement

The European Commission has announced the completion of negotiations with Switzerland on a broad package of agreements aimed at deepening and expanding bilateral relations. The package includes updates to five existing internal market agreements, new agreements on food safety, health, and electricity, and provisions for Switzerland's participation in EU programmes. Key changes involve the application of EU law on free movement of persons, the introduction of state aid provisions, and the establishment of a Common Food Safety Area. The agreement also sets Switzerland's annual financial contribution to EU cohesion at €375m until 2036 and introduces an arbitral tribunal for dispute resolution, with involvement from the European Court of Justice on matters of EU law.

ECB fines BNP Paribas Fortis SA/NV for intentionally breaching credit risk reporting rules

The European Central Bank (ECB) has imposed an administrative penalty of €10.4m on BNP Paribas Fortis SA/NV for reporting miscalculated risk-weighted assets for credit risk. The bank may challenge the ECB’s decision before the Court of Justice of the European Union.

EIOPA revokes Guidelines and amends Opinion to align with upcoming DORA

The European Insurance and Occupational Pensions Authority (EIOPA) has announced that, in anticipation of the Digital Operational Resilience Act (DORA) coming into application, it will be withdrawing two previously published Guidelines and amending part of an Opinion. The two Guidelines and Opinion are all related, at least in part, to the use of information communication technology (ICT) by undertakings, and by withdrawing them, EIOPA aims to avoid duplications and overlaps with DORA. The changes will take effect from 17 January 2025.