We use a cloud service with servers outside the EU. Is that a transfer?

If personal data go to a country outside the Union to be processed there, and under Article 4 processing includes storage, that is a transfer within the meaning of Article 44. You may do so only if you and your processor comply with the conditions of Chapter V. Which condition applies is set out in Articles 45 to 49, for example an adequacy decision by the Commission (Article 45).

The recipient outside the EU passes the data on to another country. Is that my responsibility?

Yes. Article 44 expressly states that the conditions of Chapter V also apply to onward transfers from the third country to another third country or another international organisation. Recital 101 explains why: the level of protection of people in the Union must not be undermined at that second step either. So you make sure the onward transfer is safeguarded in the same way.

Does this article apply to me as a processor, or only to my client?

To both. Article 44 names the controller and the processor side by side: a transfer may take place only if both comply with the conditions of this Chapter. If you work as a processor with parties outside the Union, you therefore need a valid transfer route yourself and cannot rely on the controller alone.

Article 44: General principle for transfersAI-relevant

Praxikon tracks Article 44 (General principle for transfers) under the GDPR, alongside the EU AI Act, citing the source for every statement.

Chapter VIn force since 25-05-2018

Article 44 is the basic rule for transferring personal data to countries outside the Union (third countries) and to international organisations. Such a transfer may take place only if the controller and the processor comply with the conditions of Chapter V, in addition to all other rules of the GDPR. This also applies to onward transfers from that third country to yet another country or another international organisation. The article exists because international data flows are necessary for trade and cooperation, but the protection people enjoy in the Union must not be undermined as a result (recital 101); international agreements with appropriate safeguards remain possible (recital 102). All rules of the Chapter must be applied with that aim in mind; the concrete routes are set out in Articles 45 to 49, starting with the adequacy decision (Article 45).

Key term: Third country: a country outside the Union; personal data may be transferred there only under the conditions of Chapter V, including for onward transfers from that country

Directly affects:controllerprocessordata subject

Praxikon’s reading of the text and the recitals; the official text below prevails.

AI Act intersection

Transfer rules are relevant when AI training data contains personal data processed outside the EU (cloud hosting, API calls).

AI Act Art. 10 →

Official text

Any transfer of personal data which are undergoing processing or are intended for processing after transfer to a third country or to an international organisation shall take place only if, subject to the other provisions of this Regulation, the conditions laid down in this Chapter are complied with by the controller and processor, including for onward transfers of personal data from the third country or an international organisation to another third country or to another international organisation. All provisions in this Chapter shall be applied in order to ensure that the level of protection of natural persons guaranteed by this Regulation is not undermined.

Source: EUR-Lex, Regulation (EU) 2016/679. Official text, reproduced without modification.

Decision tree

May you transfer personal data outside the EEA?

A transfer also includes: a supplier outside the EEA with remote access, or a cloud or AI service processing data outside the EEA. This check comes on top of the ordinary GDPR requirements, such as a legal basis.

Question 1 · art. 44

Do you transfer personal data to a recipient in a country outside the EEA or to an international organisation, or make them accessible to such a recipient?

Full diagram

1
Do you transfer personal data to a recipient in a country outside the EEA or to an international organisation, or make them accessible to such a recipient?
art. 44
- Yes → Question 2
- No, everything stays within the EEA → Outcome A
2
Has the European Commission adopted an adequacy decision for that country, territory or sector?
art. 45
- Yes → Outcome B
- It concerns the United States → Question 3
- No → Question 4
3
Is the US recipient actively listed under the EU-US Data Privacy Framework, and does this transfer fall within its certification, for example for HR data where employee data are concerned?
art. 45 · EU-VS Data Privacy Framework
- Yes → Outcome C
- No → Question 4
4
Can you provide appropriate safeguards, such as the Commission’s standard contractual clauses, binding corporate rules, an approved code of conduct or certification with binding commitments, or a binding instrument between public authorities?
art. 46 · art. 47
- Yes → Question 5
- No → Question 6
5
Does a transfer impact assessment (TIA) show that the law and practice in the recipient’s country do not undermine the safeguards, where necessary with supplementary measures such as encryption for which only you hold the key?
Art. 46(1) · HvJ EU C-311/18
- Yes → Outcome D
- No → Question 6
6
Does a specific derogation apply to this occasional transfer: explicit consent after being informed of the risks, necessity for a contract with or in the interest of the data subject, important reasons of public interest, legal claims, vital interests where the data subject cannot give consent, or a public register?
Art. 49(1) · Art. 49(3)
- Yes → Outcome E
- No → Outcome F

Outcome A · Does not apply

No transfer outside the EEA

Chapter V does not apply. Do check whether sub-processors or support teams of your suppliers outside the EEA can obtain access; that is also a transfer.

art. 44

Outcome B · Applies

Allowed on the basis of an adequacy decision

A transfer to a country with an adequacy decision requires no specific authorisation or extra safeguard. Do monitor whether the decision remains in force, and mention the transfer in your privacy notice and record of processing.

Art. 45(1) · Art. 13(1)(f) · Art. 30(1)(e)

Outcome C · Applies

Allowed through the EU-US Data Privacy Framework

A transfer to a certified US organisation is covered by the adequacy decision of 10 July 2023. Check the certification periodically, and include a fallback option in contracts, such as standard contractual clauses, in case the decision lapses.

Art. 45(1)

Outcome D · Applies

Allowed with appropriate safeguards and a transfer impact assessment

Conclude the instrument, implement the supplementary measures and record the transfer impact assessment. Repeat the assessment when the law or practice in the recipient country changes. If protection is no longer possible, suspend the transfer.

Art. 46(1) · Art. 46(2) · art. 47

Outcome E · Partly applies

Only allowed as an occasional derogation

You may base this transfer on the derogation, but only to the extent strictly necessary and as long as it remains occasional. Record which derogation you use and why the conditions are met. For structural transfers you need an adequacy decision or appropriate safeguards.

Art. 49(1) · overweging 111

Outcome F · Prohibited

Transfer not allowed

Without an adequacy decision, appropriate safeguards that work in practice, or an applicable derogation you may not transfer. Choose a supplier or hosting within the EEA, or set up the service so that the recipient receives no readable data.

art. 44 · art. 46 · art. 49

What does this mean for you?

Controller

Before you send personal data to a country outside the Union or to an international organisation, you determine which condition of Chapter V you rely on, and you record it. This applies, for example, when you use an AI service whose provider processes the data outside the Union. You also make sure the recipient does not pass the data on to yet another country without a valid route, because that onward transfer is covered by this article as well.

Processor

Under Article 44 the conditions of Chapter V apply directly to you as processor too. If you transfer data to a third country, for example through a subcontractor outside the Union, you must comply with those conditions yourself.

Data Subject

The article guarantees that the protection you enjoy under the GDPR does not disappear once your data leave the Union (recital 101). That level of protection remains the benchmark for onward transfers from the third country as well.

Compliance checklist

All transfers of personal data to countries outside the Union or to international organisations have been mapped (Article 44).For every transfer it is recorded which condition of Chapter V the organisation relies on (Article 44).In addition to the transfer conditions, every transfer also complies with the other provisions of the GDPR that apply to the processing itself (Article 44).Onward transfers by the recipient from the third country to another third country or another international organisation are known and meet the same conditions (Article 44).Processors that transfer data on behalf of the organisation comply with the conditions of Chapter V themselves (Article 44).When choosing a transfer route, it has been assessed that the level of protection of data subjects is not undermined (Article 44, recital 101).

Related recitals

(101)

Flows of personal data to and from countries outside the Union and international organisations are necessary for the expansion of international trade and international cooperation. The increase in suc...

(102)

This Regulation is without prejudice to international agreements concluded between the Union and third countries regulating the transfer of personal data including appropriate safeguards for the data ...

In addition to the overview at the bottom of this page: rulings, guidelines and fines that interpret or apply this article, newest first. Each item was checked against the official source.

Case law (2)

8 January 2025 · T-354/22 · General CourtRegulation 2018/1725
Bindl v Commission
The General Court orders the Commission to pay 400 euros: a Facebook sign-in link on its website sent an IP address to the US without an appropriate safeguard. Decided under Regulation 2018/1725.
6 November 2003 · C-101/01 · CJEUDirective 95/46
Lindqvist
Naming people on a web page is automated processing that falls outside the household exemption; a foot injury is health data, and uploading to an EU-hosted site is not a transfer to a third country.

Fines (1)

22 July 2024 · Dutch Data Protection Authority€290,000,000
Uber: drivers' data transferred to the US
For more than two years Uber transferred sensitive data of European drivers to its US headquarters without a valid transfer tool, having stopped using standard contractual clauses in August 2021. As a result the data were not adequately protected.
Decision of 22 July 2024, announced on 26 August 2024. Uber announced it would object; no outcome of that objection was found.

Line of case lawTransfers to the US: from Safe Harbour to the Data Privacy Framework

When may personal data go to the US and other third countries?

Safe Harbour (adequacy decision, invalid) (2000)First US adequacy arrangement, based on self-certification.
Schrems I (2015)The Court invalidates Safe Harbour; supervisory authorities must be able to examine transfer complaints.
EU-US Privacy Shield (adequacy decision, invalid) (2016)Successor with an Ombudsperson as an extra safeguard.
Schrems II (2020)Privacy Shield falls too; standard contractual clauses survive, but with an assessment per transfer.
Recommendations 01/2020 on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data (2021)The EDPB sets out how to carry out that assessment and which supplementary measures fit.
Standard contractual clauses for transfers to third countries (2021)New standard contractual clauses that build in the Schrems II assessment.
Meta: transfers of Facebook data to the US (2023)Largest GDPR fine to date, for transfers of Facebook data to the US.
EU-US Data Privacy Framework (adequacy decision) (2023)Third US adequacy decision, with a new redress mechanism.
Bindl v Commission (2025)First damages awarded for an unlawful transfer to the US, by an EU institution.
Latombe v Commission (2025)The General Court upholds the Data Privacy Framework; an appeal is pending.

Checked on 5 November 2026

Frequently asked questions

← Art. 43: Certification bodies Art. 45: Transfers on the basis of an adequacy decision →

Connections

Case law

Schrems II: Privacy Shield invalid, transfers under standard clauses only with essentially equivalent protection
2020-07-16 · final, Hof van Justitie van de EU (Grote kamer), Data Protection Commissioner tegen Facebook Ireland Ltd en Maximillian Schrems

Guidelines

Guidelines 05/2021 on the Interplay between the application of Article 3 and the provisions on international transfers as per Chapter V of the GDPR
2023-02-14 · final, European Data Protection Board (EDPB)
Recommendations 01/2020 on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data
2021-06-18 · final, European Data Protection Board (EDPB)

Enforcement and fines

290 million euro fine for Uber over transfers of driver data to the US
2024-08-26 · under appeal, Autoriteit Persoonsgegevens
100 million euro fine for MLU B.V. (Yango) for transfers to Russia
2026-04-01 · status not established, Autoriteit Persoonsgegevens