Key points
- Using a tool hosted outside the European Economic Area almost always involves a transfer of personal data governed by the GDPR.
- Article 44 lays down the principle: the transfer must not undermine the level of protection of individuals.
- The order of legal bases is: adequacy decision (Article 45), appropriate safeguards including SCCs (Article 46), then strict derogations (Article 49).
- The clauses to use are those of Implementing Decision 2021/914 of 4 June 2021, which are modular depending on the role of the parties.
- Decision 2021/915 concerns Article 28 (controller/processor) and does not apply to transfers outside the EU.
- Since the Schrems II judgment (16 July 2020, C-311/18), signing is no longer enough: you must assess the actual protection and provide for supplementary measures.
Using a tool hosted in the United States, customer support located outside the Union or an international cloud provider almost always involves a transfer of personal data outside the European Economic Area. The GDPR does not prohibit it, but it regulates it strictly: the level of protection guaranteed to individuals must “travel” with the data. Standard contractual clauses are the most common tool for providing this framework, provided that you use the right decision and do not stop at signing them. Since the Schrems II judgment, signing clauses is no longer enough: you must also assess the reality of protection in the destination country. This article ranks the possible legal bases and specifies which clauses to use.
Every transfer is different: the appropriate legal basis depends on the destination country, how the parties are set up and the nature of the data. The analysis below sets out the method, not a ready-made solution.
Why a data transfer outside the EU needs a legal framework
Article 44 GDPR lays down the principle: a transfer to a third country may take place only in compliance with the conditions of Chapter V, so as not to undermine the level of protection of individuals. A transfer carried out without a valid legal basis amounts to non-compliance, exposing both the controller and the processor.
The order of legal bases under Chapter V
The adequacy decision
Article 45 allows transfers to a country that the European Commission has recognised as offering an adequate level of protection. No additional contractual instrument is then required. You still need to check that an adequacy decision is actually in force for the country concerned on the date of the transfer, as the list changes over time.
Appropriate safeguards, including SCCs
In the absence of adequacy, Article 46 allows the transfer subject to “appropriate safeguards”. Among them, the Commission’s standard contractual clauses (Article 46(2)(c)) are the most widely used route, alongside binding corporate rules (BCRs) for groups.
Derogations, strictly limited
Finally, Article 49 provides for derogations for specific situations (explicit and informed consent, performance of a contract with the data subject, important reasons of public interest). These derogations are interpreted strictly: Recital 111 of the GDPR refers to occasional transfers, and they cannot serve as the basis for large-scale or repeated transfers.
Which standard contractual clauses to use? Decision 2021/914
The clauses to use for a transfer outside the EU are those of Commission Implementing Decision (EU) 2021/914 of 4 June 2021. It takes a modular approach: you select the module that matches the role of the parties (controller to controller, controller to processor, processor to processor, processor to controller). This decision replaced the former clauses; earlier contracts only benefited from a transitional period that expired on 27 December 2022.
A common confusion must be avoided: Decision (EU) 2021/915, adopted on the same day, concerns clauses between controller and processor under Article 28. It does not apply to transfers outside the EU. The two instruments serve different purposes and are not interchangeable.
The requirement arising from the Schrems II judgment
In its judgment of 16 July 2020 (Case C-311/18), the Court of Justice of the European Union confirmed the validity of SCCs, while ruling that signing them alone is not enough. The exporter must assess whether the law of the destination country actually allows the safeguards provided for to be complied with, in particular with regard to the scope for local authorities to access the data. Where this protection is not ensured, supplementary measures (technical, such as encryption, or legal and organisational) must be adopted; otherwise the transfer must be suspended. The same decision invalidated the “Privacy Shield”.
In practice: how to make a data transfer outside the EU legally sound
- Map actual transfers, including remote access and sub-processors.
- First check whether an up-to-date adequacy decision exists for the country concerned.
- Failing that, select the relevant module of the 2021/914 SCCs and incorporate it into the contract.
- Document a transfer impact assessment and, if necessary, supplementary measures.
- Keep the Article 49 derogations for genuinely one-off cases.
Points to watch
- SCCs are not self-sufficient: the third-country analysis is an integral part of compliance.
- Access from a third country to data stored in the Union is already a transfer.
- The right SCC module depends on the exact role of the parties: choosing the wrong module weakens the arrangement.
- Compliance is assessed on the date of the transfer: adequacy decisions and guidelines change.
When should you consult a lawyer?
A lawyer’s support is valuable to characterise transfers, choose the appropriate legal basis, select and complete the SCCs, and formalise the transfer impact assessment. This work forms part of an overall personal data protection (in French) and GDPR compliance strategy. Where the transfer takes place through a service provider, it is handled together with the data processing agreement.
The answer may vary depending on the facts, the drafting of the contract and developments in the applicable case law.
What the law says
Transfers of data outside the Union follow a strict principle: a transfer to a third country “shall take place only if, subject to the other provisions of this Regulation, the conditions laid down in this Chapter are complied with by the controller and processor” (Article 44 GDPR), so as to preserve the level of protection guaranteed by the Regulation. In the absence of an adequacy decision from the European Commission, “a controller or processor may transfer personal data to a third country or an international organisation only if the controller or processor has provided appropriate safeguards, and on condition that enforceable data subject rights and effective legal remedies for data subjects are available” (Article 46, paragraph 1): standard contractual clauses, binding corporate rules, etc.
Official sources
- Article 44 GDPR, general principle for transfers: CNIL (in French)
- Article 46 GDPR, transfers subject to appropriate safeguards: CNIL (in French)
Every situation is different. To put an international data transfer on a sound legal footing, our GDPR lawyers are here to assist you.
