Third-country data transfers

Treat every outbound system as a data-flow question. Before approving a vendor, map which organisation receives or can access prospect data, where it operates, and which route covers the handoff. An EEA organisation can make a transfer when it shares data with a non-EEA controller or processor, even if the recipient is already subject to the GDPR.¹ If a processor or sub-processor exports the data, the controller remains responsible for transfer compliance.²

The transfer check

Run the check in this order. Stop if you cannot explain who receives the data, where the handoff goes, and which safeguards cover it.

1. Map the route.

Start with the record, the handoff, and the destination. A third country is any country outside the EEA.³ The GDPR contains specific provisions for transfers outside the EEA, aimed at giving transferred data the same level of protection it has within the EEA.^{4, 5}

Record where each field is stored, which organisation receives it, and where people can access it. Ask:

• Where is prospect data stored?
• Which legal entity receives it?
• From which countries can staff or support teams access it?
• Which subcontractors or internal divisions can process it?
• Does any part of the route leave the EEA?

"The vendor's cloud" is not enough. Keep asking until you have a country and a receiving organisation for each handoff.

2. Apply the transfer screen.

Use the transfer test before discussing contract language. The EDPB identifies three cumulative criteria for a transfer outside the EEA.⁶

First, ask whether a controller or processor is subject to the GDPR for the processing in question.⁷ Then ask whether that party discloses the data, or otherwise makes it available, to another controller or processor.⁸ Treat the screen as cumulative. A positive answer to one question does not settle the route.

Keep the analysis tied to the actual movement of data. A prospect's direct and self-initiated provision of personal information to an organisation outside the EEA is not a transfer.⁹ That does not answer what happens when your organisation sends a prospect record to an outbound service.

3. Set responsibility and instructions.

Assign responsibility before accepting a vendor's explanation of its paperwork. The Chapter V transfer rules apply to processors as well as controllers.¹⁰

Ask who decides the purpose and means of processing, who sends the data, and who appoints each sub-processor. A processor is responsible when it initiates a transfer, usually to a sub-processor.¹¹ If the arrangement includes joint controllers, allocate transfer responsibilities between them.¹²

The contract should specify the requirements for transfers to third countries or international organisations, taking account of Chapter V.¹³ If your instructions prohibit third-country transfers or disclosures, the processor cannot appoint a third-country sub-processor or process the data in a non-EU division.¹⁴ Put that restriction in the instructions, then check whether the vendor's actual route follows it.

4. Check adequacy first.

Once you know the destination, check the available routes in a fixed order. The first consideration for a transfer to a third country is whether an adequacy decision exists.¹⁵

An adequacy decision means that the European Commission has determined that the third country or international organisation ensures an adequate level of data protection.¹⁶ Ask the vendor to identify the destination covered by the decision and the receiving organisation to which it applies.

If no adequacy decision covers the route, ask which safeguard permits the transfer. Transfers outside the EU or EEA are permitted only when specific safeguards are in place.¹⁷ Standard Contractual Clauses, Binding Corporate Rules, Codes of Conduct, and Certification Mechanisms must be in place for the specified cross-border transfers.¹⁸ Derogations may apply only in very specific circumstances.¹⁹ Treat a derogation as an escalation point, record the facts, and do not accept it as a routine vendor answer.

5. Test the safeguard against the contract.

A safeguard is useful only if it covers the route you mapped. Read the contract alongside the vendor's answers and check each destination, receiving organisation, and processing activity.

Ask:

• Which safeguard covers this specific destination?
• Which contract clause addresses the transfer?
• Does the clause cover storage, access, support, and sub-processors?
• What do the processing instructions permit or prohibit?
• If the vendor says the recipient is already subject to the GDPR, which transfer mechanism applies?

The current Standard Contractual Clauses apply only where the importer is not subject to the GDPR.²⁰ If a vendor says it uses SCCs, check that they apply before treating the answer as complete.

6. Check for other territorial rules.

Finish by checking whether another country's law affects the route. Laws in other territories may impose specific restrictions on international data transfers.²¹ Ask the vendor and your privacy contact whether the destination adds requirements beyond the route you have assessed.

Move on only when your record names the data, route, receiving organisation, destination, safeguard, and contract instruction. Escalate when one of those pieces is missing or when the vendor's answer changes depending on whether it is describing storage, access, or a sub-processor.

Questions to use on a vendor call

Use short questions that require a country-by-country answer. The aim is to turn a broad compliance statement into a route you can check.

• Which legal entity receives the prospect records after they leave our environment?
• In which countries are the records stored?
• In which countries can the records be accessed for support, maintenance, or operations?
• Which other organisations or internal divisions can process them?
• Does any other organisation initiate a transfer from the service?
• Is the destination covered by an adequacy decision?
• If it is not, which safeguard covers the transfer?
• Where does the contract address the transfer requirements?
• Can our processing instructions prohibit transfers to a particular destination?
• What changes if a new sub-processor or access location is introduced?

Listen for precise answers that separate the vendor's contracting entity from the places where data is stored or accessed. If the answer remains at the level of "global infrastructure" or "standard compliance," return to the route and ask for the receiving entity, country, and safeguard.

What not to do

Keep these mistakes out of the approval record.

• Do not treat a broad contractual exception as permission to transfer personal data. Such an exception does not override the GDPR's transfer restrictions or count as the controller's instruction to transfer.²²
• Do not approve a route because a vendor says it has a European office. Identify the receiving organisation and the countries where the data can be accessed.
• Do not treat a processor's export as someone else's compliance problem. The controller remains responsible for ensuring transfer compliance when a processor or sub-processor acts as the exporter.²
• Do not assume that another country's rules are irrelevant once the GDPR route is documented. Other territories may impose their own restrictions.²¹
• Do not wait for a breach or complaint before checking the transfer file. Restricted transfers are likely to receive regulatory scrutiny in either situation.²³

Use the record during approval and revisit it whenever the vendor describes a new access location, receiving organisation, or sub-processor.