Third country transfers and their relevance for data protection officers in Germany

Data transfers to countries outside the EU or the EEA – so-called third country transfers – are a key aspect for data protection officers in Germany. The GDPR places strict requirements on such transfers to ensure that personal data also remains protected outside Europe.

Data protection officers must check whether an adequacy decision has been issued by the EU Commission for the third country in question or whether suitable guarantees, such as standard contractual clauses or binding corporate rules (BCRs), have been implemented. In the absence of such guarantees, data subjects must give their explicit consent or an exception under Art. 49 GDPR must apply.

Particular attention is being paid to data protection in the USA, especially since the abolition of the Privacy Shield. Regular audits and risk assessments are necessary to ensure compliance. Third-country transfers therefore require continuous vigilance and sound legal assessment in order to transfer data securely and in compliance with the GDPR.