International data transfer
Definition
An international data transfer is making personal data available to a recipient in another country, permitted only through a recognised mechanism such as an adequacy decision or appropriate safeguards.
Chapter V of the GDPR (Arts. 44-50) allows transfers outside the European Economic Area only on one of these grounds: an adequacy decision by the European Commission; appropriate safeguards such as standard contractual clauses or binding corporate rules; or narrow derogations, for example explicit consent or the performance of a contract, used occasionally. After the Schrems II ruling, exporters relying on safeguards must also assess whether the destination country's laws undermine them and adopt supplementary measures when needed.
The LGPD (Arts. 33-36) follows a similar structure, detailed by ANPD Resolution CD/ANPD 19/2024, which approved Brazilian standard contractual clauses and rules for their use.
Transfers happen far more often than teams notice: remote access by a support team abroad, a cloud region outside the country or a call to an AI model hosted elsewhere all count. Example: a Brazilian retailer that sends customer chats to a US-hosted language model must identify the transfer mechanism, record it and inform customers in its privacy notice.
Where this term is assessed
Assessed in the Data Protection & AI Professional (DPAI), domain 5: International transfers and vendors.
Also covered in: Responsible AI Practitioner (RAIP)
Primary sources
- GDPR Chapter V (Arts. 44-50)
- LGPD Arts. 33-36
- Resolução CD/ANPD nº 19/2024