GDPR Article 44: Lawful Paths for Data Transfers Outside the EEA

GDPR Article 44 sets the general principle for international data transfers: personal data cannot leave the European Economic Area unless the protections the GDPR guarantees travel with it. The rule is short, but it governs the whole of Chapter V and sits behind fines of up to €20 million or 4% of worldwide annual turnover. If your organization sends personal data to any recipient outside the EEA, Article 44 decides which legal mechanism you need before the data moves.

What Article 44 Requires

The article has two sentences. The first says any transfer of personal data that is being processed, or is intended for processing after arrival in a third country or at an international organization, may only take place if the controller and the processor comply with the conditions in Chapter V. The second says the provisions of that chapter apply to ensure the level of protection guaranteed to individuals by the GDPR is not undermined.¹

That second sentence is the interpretive key for everything that follows in Chapter V. Whenever a supervisory authority asks whether a safeguard, a clause, or a workaround is good enough, the test is whether the GDPR’s level of protection survives the trip. If protection drops, the transfer fails.

The rule also covers onward transfers. If your data reaches a company in Brazil and that company forwards it to a partner in India, Chapter V applies at every hop. The exporter’s responsibility does not end when the data lands with the first recipient.¹

What Counts as a Transfer

The European Data Protection Board has set out three criteria that must all be met for a data flow to qualify as a transfer under Chapter V. The entity disclosing the data must itself be subject to the GDPR. That entity must make personal data available to a separate organization, whether by sending it or by granting access. And the recipient must be located in a country outside the EEA, or be an international organization.²

This catches more than file transfers. If an employee at a subsidiary in Singapore can open customer records held on a server in Frankfurt, that remote access counts. So does cloud storage processed outside the EEA, outsourced support teams working abroad, and shared databases reachable by foreign affiliates. A single record triggers the same obligations as a million.

International organizations, meaning bodies set up by treaty between countries, sit inside the same rules. Public international law sometimes gives these organizations immunities that might otherwise sidestep data protection oversight, and Article 44 closes that gap by treating them the same as any third-country recipient.¹

The Essential Equivalence Standard

The benchmark all Chapter V mechanisms are measured against is “essential equivalence,” a standard the Court of Justice of the European Union laid down in Schrems II. The recipient country must provide a level of protection essentially equivalent to what the GDPR and the EU Charter of Fundamental Rights guarantee. Not identical, but close enough that individuals do not lose meaningful control over their data.³

The test looks at both the law and how it works in practice. A country may have a serviceable privacy statute on paper while allowing intelligence agencies broad, unchecked access to personal data. In that case the protection is not essentially equivalent, whatever the statute says. Data exporters are expected to check conditions on the ground before sending anything, and supervisory authorities must block transfers where individuals lack that level of protection.³

The Three Lawful Paths Out of the EEA

Chapter V arranges the options in a hierarchy. The simplest is transferring to a country the European Commission has already approved through an adequacy decision. The second is using appropriate safeguards such as Standard Contractual Clauses or Binding Corporate Rules. The third, which the EDPB stresses should be a last resort, is one of the narrow derogations under Article 49.⁴

Adequacy Decisions

An adequacy decision is a formal Commission finding that a country’s data protection framework meets the essential equivalence standard. Transfers to an adequate country work almost like transfers within the EEA, with no additional safeguard needed. As of 2026, the Commission recognizes Andorra, Argentina, Brazil, Canada (commercial organizations only), the Faroe Islands, Guernsey, Israel, the Isle of Man, Japan, Jersey, New Zealand, the Republic of Korea, Switzerland, the United Kingdom, Uruguay, and the European Patent Organisation. The United States is on the list only for commercial organizations that have self-certified under the EU-U.S. Data Privacy Framework. The UK’s adequacy status was renewed in December 2025. Adequacy is not permanent; the Commission reviews decisions periodically and can revoke them.⁵

The U.S. adequacy decision, effective July 10, 2023, works differently from the others. It covers only organizations that have voluntarily self-certified through the Department of Commerce’s Data Privacy Framework program, and certified organizations must re-certify annually. Any organization removed from the active list must stop claiming DPF compliance immediately while continuing to protect data received during participation.⁶ Before you rely on the DPF, check the recipient’s active status on the official, searchable Data Privacy Framework List.⁷

Standard Contractual Clauses and Transfer Impact Assessments

Where no adequacy decision applies, Standard Contractual Clauses are the most widely used route. The Commission adopted the current SCCs in June 2021. They are pre-approved contract templates that both exporter and recipient sign, imposing GDPR-equivalent obligations on the recipient by contract and giving individuals enforceable rights even though the recipient sits outside the EEA.⁸

The clauses use a modular structure with four configurations covering controller-to-controller, controller-to-processor, processor-to-processor, and processor-to-controller relationships. You pick the module that matches your setup, complete the annexes with the transfer-specific details, and sign.

Signing alone is not enough. Schrems II made clear that the exporter must verify the receiving country’s legal environment can actually support the contractual commitments. If it cannot, you need supplementary measures on top of the clauses. The EDPB’s Recommendations 01/2020 set out how to run that check as a Transfer Impact Assessment: map the data and destinations, identify the transfer tool, assess whether local laws or surveillance practices could undermine the safeguards, and adopt supplementary measures where they could.⁹

Supplementary measures fall into three categories. Technical measures include end-to-end encryption where the recipient cannot access the decryption key. Contractual measures add commitments beyond the standard clauses. Organizational measures cover internal access controls and audit procedures. The EDPB is explicit: if no combination of measures can lift protection to an essentially equivalent level, the transfer must be suspended. There is no good-faith-effort exception. Because legal landscapes shift, you also need to reassess periodically.⁹

Binding Corporate Rules

Binding Corporate Rules suit multinational corporate groups that transfer personal data regularly among their own entities worldwide. Where SCCs govern one relationship at a time, BCRs create a single group-wide data protection policy that every group member must follow. They must be legally binding on every entity, grant enforceable rights to individuals, and meet detailed content requirements on purpose limitation, data minimization, security, and complaint handling.⁴

The trade-off is time and cost. BCRs go through a formal cooperation procedure involving the EDPB and national supervisory authorities, typically taking well over a year and requiring significant legal work.¹⁰ For most organizations, BCRs only make sense at the scale of large corporate groups with steady intra-group data flows.

Article 49 Derogations

Article 49 provides a small set of exceptions that allow transfers without adequacy or formal safeguards, but the EDPB treats them as genuine last resorts. Because derogations skip the structural protections of Articles 45 and 46, they carry higher risks for data subjects, and authorities read them narrowly to stop the exception from swallowing the rule.¹¹

The most commonly invoked derogation is explicit consent, but the conditions are strict. The individual must give an express statement of consent specific to the particular transfer, after being informed of the risks flowing from the absence of an adequacy decision or appropriate safeguards. Generic consent buried in a privacy policy will not do. Other derogations cover transfers necessary to perform a contract with the individual, transfers required for important reasons of public interest, and transfers needed to protect someone’s vital interests. Each is limited in scope and meant for occasional rather than systematic data flows.¹¹

Documentation You Must Keep

Article 44’s accountability principle means proving compliance, not just achieving it. Under Article 30, both controllers and processors must maintain records of processing activities that specifically document international transfers. Controller records must identify the third country or international organization receiving the data, the categories of recipients, and, where transfers rely on Article 49 derogations, a description of the safeguards in place.¹²

Processors carry a parallel obligation and must record the same transfer details. Beyond Article 30 records, organizations using SCCs should keep their signed clauses and Transfer Impact Assessments accessible. Supervisory authorities can request this material during investigations, and failing to produce it is itself a compliance failure, separate from whatever triggered the inquiry.¹²

Penalties and Where the Responsibility Sits

Violations of Articles 44 through 49 fall into the GDPR’s highest penalty tier. Supervisory authorities can impose administrative fines of up to €20 million or, for businesses, up to 4% of total worldwide annual turnover from the preceding financial year, whichever is higher. The calculation is not mechanical. Authorities weigh the nature and severity of the violation, the number of people affected, mitigation steps, and whether the breach was deliberate or negligent.¹³

Authorities can also order a transfer suspended or banned. For organizations whose operations depend on cross-border data flows, that can be more disruptive than any fine. The responsibility sits with the data exporter, meaning the controller or processor initiating the transfer, and it extends through every link in the onward chain. If your processor sends data to a sub-processor in a country you never vetted, that is your compliance problem, not just theirs.¹

1
General Data Protection Regulation (GDPR). Art. 44 GDPR – General Principle for Transfers
2
European Data Protection Board. International Data Transfers
3
European Parliamentary Research Service. The CJEU Judgment in the Schrems II Case
4
General Data Protection Regulation (GDPR). Art. 46 GDPR – Transfers Subject to Appropriate Safeguards
5
European Commission. Data Protection Adequacy for Non-EU Countries
6
Data Privacy Framework. Data Privacy Framework Program Overview
7
Data Privacy Framework. Data Privacy Framework Participants List
8
European Commission. Standard Contractual Clauses (SCC)
9
European Data Protection Board. Recommendations 01/2020 on Supplementary Measures for Transfer Tools
10
European Data Protection Board. Co-Operation Procedure for the Approval of Binding Corporate Rules
11
European Data Protection Board. Guidelines 2/2018 on Derogations of Article 49
12
General Data Protection Regulation (GDPR). Art. 30 GDPR – Records of Processing Activities
13
General Data Protection Regulation (GDPR). Art. 83 GDPR – General Conditions for Imposing Administrative Fines