What is a transfer to a third country?

A third-country transfer is when personal data is transferred to a country outside the EU and EEA, which is only allowed under certain conditions.

The GDPR aims to protect data even when it leaves the EU. A transfer therefore needs a decision from the European Commission that the country offers adequate protection, or other appropriate safeguards.

A common safeguard is standard contractual clauses. They often need to be backed by an assessment of the country's laws and which authorities can demand access to the data.

Access counts too. If a supplier's support team outside the EU can read the data, that can be a transfer even when the servers are in Sweden.

How it works

The assessment is done in steps. First, map where the data goes, including sub-processors and support. Then choose a basis for the transfer. Without an adequacy decision, assess whether the destination country's laws allow the protection to hold in practice, and which supplementary measures are needed.

Why it matters

The question often decides which AI services you can use. Many are run by companies based outside the EU. Laws in some countries can let authorities demand data from companies based there, wherever the servers are. That makes the supplier's home country as important as where the data is stored.

What to keep in mind

The basis for a transfer can change. The EU Court of Justice has previously struck down frameworks for transfers to the United States, and it could happen again. Have a plan for that case.

Encryption can be a supplementary measure, but only if the keys are not held by the recipient.

What it means for you

Ask where the data is stored, where it is processed and where the people with access are located.

Common questions

Is it a transfer if the supplier's servers are in the EU?

It can be. If staff or sub-processors outside the EU and EEA can access the data, that can count as a transfer.

Can we use an AI service from the United States?

It can be lawful, for example if the supplier is certified under the EU-US Data Privacy Framework or appropriate safeguards are in place. Assess each service on its own merits.

How do we avoid transfers altogether?

By having the data processed within the EU and EEA by suppliers that give no access from outside, or in your own environment.

Sources: GDPR, Chapter V, on EUR-Lex Transfer of data to a third country at IMY

Related terms

All terms Updated 2026