We use a cloud service with servers outside the EU. Is that a transfer?

If personal data go to a country outside the Union to be processed there, and under Article 4 processing includes storage, that is a transfer within the meaning of Article 44. You may do so only if you and your processor comply with the conditions of Chapter V. Which condition applies is set out in Articles 45 to 49, for example an adequacy decision by the Commission (Article 45).

The recipient outside the EU passes the data on to another country. Is that my responsibility?

Yes. Article 44 expressly states that the conditions of Chapter V also apply to onward transfers from the third country to another third country or another international organisation. Recital 101 explains why: the level of protection of people in the Union must not be undermined at that second step either. So you make sure the onward transfer is safeguarded in the same way.

Does this article apply to me as a processor, or only to my client?

To both. Article 44 names the controller and the processor side by side: a transfer may take place only if both comply with the conditions of this Chapter. If you work as a processor with parties outside the Union, you therefore need a valid transfer route yourself and cannot rely on the controller alone.

Article 44: General principle for transfersAI-relevant

Praxikon tracks Article 44 (General principle for transfers) under the GDPR, alongside the EU AI Act, citing the source for every statement.

Chapter VIn force since 25-05-2018

Article 44 is the basic rule for transferring personal data to countries outside the Union (third countries) and to international organisations. Such a transfer may take place only if the controller and the processor comply with the conditions of Chapter V, in addition to all other rules of the GDPR. This also applies to onward transfers from that third country to yet another country or another international organisation. The article exists because international data flows are necessary for trade and cooperation, but the protection people enjoy in the Union must not be undermined as a result (recital 101); international agreements with appropriate safeguards remain possible (recital 102). All rules of the Chapter must be applied with that aim in mind; the concrete routes are set out in Articles 45 to 49, starting with the adequacy decision (Article 45).

Key term: Third country: a country outside the Union; personal data may be transferred there only under the conditions of Chapter V, including for onward transfers from that country

Directly affects:controllerprocessordata subject

Praxikon’s reading of the text and the recitals; the official text below prevails.

AI Act intersection

Transfer rules are relevant when AI training data contains personal data processed outside the EU (cloud hosting, API calls).

AI Act Art. 10 →

Official text

Any transfer of personal data which are undergoing processing or are intended for processing after transfer to a third country or to an international organisation shall take place only if, subject to the other provisions of this Regulation, the conditions laid down in this Chapter are complied with by the controller and processor, including for onward transfers of personal data from the third country or an international organisation to another third country or to another international organisation. All provisions in this Chapter shall be applied in order to ensure that the level of protection of natural persons guaranteed by this Regulation is not undermined.

Source: EUR-Lex, Regulation (EU) 2016/679. Official text, reproduced without modification.

What does this mean for you?

Controller

Before you send personal data to a country outside the Union or to an international organisation, you determine which condition of Chapter V you rely on, and you record it. This applies, for example, when you use an AI service whose provider processes the data outside the Union. You also make sure the recipient does not pass the data on to yet another country without a valid route, because that onward transfer is covered by this article as well.

Processor

Under Article 44 the conditions of Chapter V apply directly to you as processor too. If you transfer data to a third country, for example through a subcontractor outside the Union, you must comply with those conditions yourself.

Data Subject

The article guarantees that the protection you enjoy under the GDPR does not disappear once your data leave the Union (recital 101). That level of protection remains the benchmark for onward transfers from the third country as well.

Compliance checklist

All transfers of personal data to countries outside the Union or to international organisations have been mapped (Article 44).For every transfer it is recorded which condition of Chapter V the organisation relies on (Article 44).In addition to the transfer conditions, every transfer also complies with the other provisions of the GDPR that apply to the processing itself (Article 44).Onward transfers by the recipient from the third country to another third country or another international organisation are known and meet the same conditions (Article 44).Processors that transfer data on behalf of the organisation comply with the conditions of Chapter V themselves (Article 44).When choosing a transfer route, it has been assessed that the level of protection of data subjects is not undermined (Article 44, recital 101).

Related recitals

(101)

Flows of personal data to and from countries outside the Union and international organisations are necessary for the expansion of international trade and international cooperation. The increase in suc...

(102)

This Regulation is without prejudice to international agreements concluded between the Union and third countries regulating the transfer of personal data including appropriate safeguards for the data ...

Frequently asked questions

← Art. 43: Certification bodies Art. 45: Transfers on the basis of an adequacy decision →

Connections

Case law

Schrems II: Privacy Shield invalid, transfers under standard clauses only with essentially equivalent protection
2020-07-16 · final, Hof van Justitie van de EU (Grote kamer), Data Protection Commissioner tegen Facebook Ireland Ltd en Maximillian Schrems

Guidelines

Guidelines 05/2021 on the Interplay between the application of Article 3 and the provisions on international transfers as per Chapter V of the GDPR
2023-02-14 · final, European Data Protection Board (EDPB)
Recommendations 01/2020 on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data
2021-06-18 · final, European Data Protection Board (EDPB)

Enforcement and fines

290 million euro fine for Uber over transfers of driver data to the US
2024-08-26 · under appeal, Autoriteit Persoonsgegevens
100 million euro fine for MLU B.V. (Yango) for transfers to Russia
2026-04-01 · status not established, Autoriteit Persoonsgegevens