{"answer_id":"praxikon:eu:gdpr:answer:doorgifte","canonical_page":"https://www.praxikon.com/en/antwoord/avg/doorgifte","query":"On what basis may personal data be transferred to a country outside the EEA, such as the US?","lang":"en","view":"full","mode":"gdpr","regime":"gdpr","topic":"doorgifte","question":"On what basis may personal data be transferred to a country outside the EEA, such as the US?","label":"Transfers to countries outside the EEA","answer":"A transfer to a country outside the EEA is possible on three routes, in this order (Article 44): (1) an adequacy decision of the European Commission (Article 45). For the US that is the EU-US Data Privacy Framework (Implementing Decision (EU) 2023/1795), but only for recipients certified under that framework; (2) appropriate safeguards, such as standard contractual clauses or binding corporate rules (Article 46), with an assessment of the law of the third country and, where needed, supplementary measures (Schrems II); (3) only by way of exception, the derogations of Article 49, such as explicit consent; according to the EDPB these must be interpreted restrictively and are not meant for structural transfers.","applied_to_question":null,"matched_terms":[],"articles":[{"article":44,"source_locator":"Art. 44 GDPR","point":"General principle for transfers.","source_title":"GDPR (Regulation (EU) 2016/679)","source_url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj","human_page":"https://www.praxikon.com/en/avg/artikel/44"},{"article":45,"source_locator":"Art. 45(1) GDPR","point":"Transfers on the basis of an adequacy decision.","source_title":"GDPR (Regulation (EU) 2016/679)","source_url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj","human_page":"https://www.praxikon.com/en/avg/artikel/45"},{"article":46,"source_locator":"Art. 46(2)(c) GDPR","point":"Standard contractual clauses as an appropriate safeguard.","source_title":"GDPR (Regulation (EU) 2016/679)","source_url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj","human_page":"https://www.praxikon.com/en/avg/artikel/46"},{"article":49,"source_locator":"Art. 49(1) GDPR","point":"Derogations for specific situations.","source_title":"GDPR (Regulation (EU) 2016/679)","source_url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj","human_page":"https://www.praxikon.com/en/avg/artikel/49"}],"case_law":[{"id":"c-311-18","kind":"judgment","title":"Schrems II","issuer":"CJEU","reference":"C-311/18","ecli":"ECLI:EU:C:2020:559","date":"2020-07-16","status":null,"point":"Standard contractual clauses require a case-by-case assessment.","source_url":"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62018CJ0311","human_page":null}],"guidance":[{"id":"com-2023-1795-dpf","kind":"decision","title":"EU-US Data Privacy Framework (adequacy decision)","issuer":"European Commission","reference":"(EU) 2023/1795","ecli":null,"date":"2023-07-10","status":"in-force","point":"Adequacy decision on the EU-US Data Privacy Framework.","source_url":"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32023D1795","human_page":null},{"id":"edpb-gl-2-2018","kind":"guidance","title":"Guidelines 2/2018 on derogations of Article 49 under Regulation 2016/679","issuer":"EDPB","reference":null,"ecli":null,"date":"2018-05-25","status":"final","point":"The derogations of Article 49 must be interpreted restrictively.","source_url":"https://www.edpb.europa.eu/documents/guideline/guidelines-22018-on-derogations-of-article-49-under-regulation-2016679_en","human_page":null}],"enforcement":[],"open_questions":["Is the US recipient certified under the Data Privacy Framework?"],"human_page":"https://www.praxikon.com/en/avg/artikel/44","dataset":{"id":"praxikon-gdpr","source":"https://eur-lex.europa.eu/eli/reg/2016/679/oj","known_at":"2026-09-15"},"casus_check":"https://www.praxikon.com/en/casus-check","disclaimer":"General interpretation, not legal advice. The official source remains authoritative.","methodology":"https://www.praxikon.com/en/methodologie"}