In today's globalised world, there are many cross-border
transfers of personal data, which are sometimes stored on servers
in different countries.
Chapter V of the General Data Protection Regulation (GDPR),
"Transfers of personal data to third countries or
international organisations", provides different tools to
frame data transfers from the EU to a "third country"
(i.e. a country that is not a member of the European Economic
Area). These include the following:
- Sometimes, a third country may be
declared as offering an adequate level of protection through a
European Commission decision ("Adequacy Decision"),
meaning that data can be transferred with another company in that
third country without the data exporter being required to provide
further safeguards or being subject to additional conditions
(Article 45, GDPR). In other words, the transfers to an
"adequate" third country will be comparable to a
transmission of data within the EU. Japan is the latest
