BCLP Global Data Privacy FAQs: What Counts As A "transfer" Of Data Under The EU GDPR? New Draft EU Guidelines Released

Summary

It is well known that the EU GDPR (specifically, Chapter V) restricts transfers of personal data from the EU to a "third country" (i.e. a jurisdiction outside the EEA) or to an international organisation. But what is meant by a "transfer"? And how does this apply where the extra-territorial reach of the EU GDPR (as defined in Article 3) means an organisation outside the EEA is required to comply with the EU GDPR, including Chapter V, while the personal data may already be outside the EU's territory?

On 19 November 2021, the European Data Protection Board ("EDPB") published draft Guidelines 05/2021 on the Interplay between the application of Article 3 and Chapter V of the GDPR. The EDPB identified three criteria which must all be satisfied in order for a "transfer" to occur: