General Data Protection Regulation (GDPR)

6.

International Data Transfers

6.1.

General Principle for Transfers

6.1.1.

Restrictions on Transfers Outside EEA

6.1.1.1.

Adequate Level of Protection

6.1.1.2.

Transfer Prohibition

6.1.2.

Ensuring Adequate Protection

6.1.2.1.

Protection Level Assessment

6.1.2.2.

Continuous Monitoring

6.2.

Adequacy Decisions

6.2.1.

Criteria for Adequacy

6.2.1.1.

Legal Framework Assessment

6.2.1.2.

Enforcement Mechanisms

6.2.1.3.

International Commitments

6.2.1.4.

6.2.2.

List of Adequate Countries

6.2.2.1.

6.2.2.2.

6.2.2.3.

6.2.2.4.

6.2.2.5.

6.2.2.6.

6.2.2.7.

6.2.2.8.

6.2.2.9.

6.2.2.10.

6.2.2.11.

6.2.2.12.

6.2.2.13.

6.2.3.

Partial Adequacy Decisions

6.2.3.1.

6.2.3.2.

6.2.4.

Review and Withdrawal

6.2.4.1.

Periodic Reviews

6.2.4.2.

Changed Circumstances

6.2.4.3.

Suspension Procedures

6.3.

Appropriate Safeguards

6.3.1.

Standard Contractual Clauses

6.3.1.1.

Structure and Use

6.3.1.1.1.

Module Selection

6.3.1.1.2.

Docking Clauses

6.3.1.1.3.

Variable Elements

6.3.1.2.

Updates and Requirements

6.3.1.2.1.

6.3.1.2.2.

Legacy Arrangements

6.3.1.2.3.

Transition Periods

6.3.1.3.

Transfer Impact Assessment

6.3.1.3.1.

Local Law Analysis

6.3.1.3.2.

Supplementary Measures

6.3.2.

Binding Corporate Rules

6.3.2.1.

Approval Process

6.3.2.1.1.

Consistency Mechanism

6.3.2.1.2.

6.3.2.1.3.

Cooperation Procedure

6.3.2.2.

Scope and Application

6.3.2.2.1.

6.3.2.2.2.

Processing Activities

6.3.2.2.3.

Third Country Operations

6.3.2.3.

Content Requirements

6.3.2.3.1.

Data Protection Principles

6.3.2.3.2.

Data Subject Rights

6.3.2.3.3.

Liability and Enforcement

6.3.3.

Codes of Conduct and Certification Mechanisms

6.3.3.1.

Voluntary Adoption

6.3.3.2.

Monitoring and Enforcement

6.3.3.3.

International Scope

6.3.4.

Ad Hoc Contractual Clauses

6.3.4.1.

Authorization Requirements

6.3.4.2.

Adequacy Assessment

6.3.5.

Administrative Arrangements

6.3.5.1.

Public Body Arrangements

6.3.5.2.

Enforcement Cooperation

6.4.

Derogations for Specific Situations

6.4.1.

Explicit Consent

6.4.1.1.

Informed Consent Requirements

6.4.1.2.

Specific Transfer Consent

6.4.1.3.

Withdrawal Rights

6.4.2.

Performance of Contract

6.4.2.1.

Contract with Data Subject

6.4.2.2.

Pre-Contractual Measures

6.4.2.3.

Third Party Contracts

6.4.3.

Important Reasons of Public Interest

6.4.3.1.

Public Interest Assessment

6.4.3.2.

Occasional Transfers

6.4.4.

6.4.4.1.

Establishment of Claims

6.4.4.2.

Exercise of Claims

6.4.4.3.

Defense of Claims

6.4.5.

Protection of Vital Interests

6.4.5.1.

Life-Threatening Situations

6.4.5.2.

Physical Integrity

6.4.5.3.

Incapacity to Consent

6.4.6.

Public Register Transfers

6.4.6.1.

Legal Consultation Rights

6.4.6.2.

General Public Access

6.4.7.

Restrictions on Derogations

6.4.7.1.

Occasional Nature

6.4.7.2.

Limited Data Subjects

6.4.7.3.

Compelling Legitimate Interest

Previous

5. Obligations of Controllers and Processors

Go to top

Next

7. Enforcement, Remedies, and Penalties