International data transfer
An international data transfer is the sending of personal data, or making it accessible, from the EEA to a country or organization outside it, which the GDPR allows only with an adequacy decision, appropriate safeguards or a narrow derogation.Chapter V of the GDPR, Articles 44 to 49, governs these transfers. Article 44 sets the principle that the level of protection must not be undermined, including for onward transfers. Article 45 allows transfers to countries covered by an adequacy decision. Article 46 allows them with appropriate safeguards, mainly standard contractual clauses, and Article 47 adds binding corporate rules for groups of companies. Article 48 says a foreign court or authority order alone does not justify a transfer. Article 49 lists derogations for specific situations, such as explicit consent after information on the risks, or a transfer necessary for a contract with the person, which are meant for occasional cases rather than routine flows.
The Court of Justice's Schrems II judgment (C-311/18, 16 July 2020) invalidated the Privacy Shield and required exporters using clauses to check the destination country's law. In 2022 several authorities, including Austria's and France's, found that sites using Google Analytics transferred data to the United States in breach of Chapter V. The EU-US Data Privacy Framework, in force since 10 July 2023, now covers certified US companies.
Every third-party tag is a potential transfer: an analytics script, a font, a video player or a chat widget hosted abroad receives the visitor's IP address and identifiers. The Google Fonts guide shows how small the trigger can be.