Guidelines 05/2021 on the Interplay between the application of Article 3 and the provisions on international transfers as per Chapter V of the GDPR

What it is about

The EDPB explains when there is a transfer under Chapter V, using three cumulative criteria: a controller or processor is subject to the GDPR for the processing, makes personal data available to another controller or processor, and that importer is in a third country or is an international organisation. Direct disclosure by a data subject is not a transfer. Version 2.0 was adopted on 14 February 2023 after public consultation and is final; version 1.0 dates from 18 November 2021.

What this means in practice

You first determine whether a data flow is a transfer before using standard contractual clauses or a TIA. Disclosure within a group, for example from an EU subsidiary to a parent company outside the EEA, also counts as a transfer. Remote access by a processor in a third country is a transfer, but an own employee logging in remotely during a business trip is not, because the data stay within the same controller.

The GDPR articles concerned

• Article 3: Territorial scope
• Article 44: General principle for transfers
• Article 46: Transfers subject to appropriate safeguards