Article 44 GDPR

From GDPRhub
Article 44 - General principle for transfers
Chapter 10: Delegated and implementing acts

Legal Text[edit | edit source]

Article 44 - General principle for transfers

Any transfer of personal data which are undergoing processing or are intended for processing after transfer to a third country or to an international organisation shall take place only if, subject to the other provisions of this Regulation, the conditions laid down in thisCHAPTER are complied with by the controller and processor, including for onward transfers of personal data from the third country or an international organisation to another third country or to another international organisation. All provisions in thisCHAPTER shall be applied in order to ensure that the level of protection of natural persons guaranteed by this Regulation is not undermined.

Relevant Recitals[edit | edit source]

You can help us fill this section!

Commentary[edit | edit source]

The general conditions for the transfer of personal data to countries outside the EU/EEA ("third countries") and international organisations are laid down in Article 44 GDPR. Two steps have to be taken for the lawfulness of such data transfers.

(1) Since a 'transfer' of personal data is a 'processing', the first condition is the general compliance with the provisions of the GDPR. This includes the requirement of a legal basis according to Art. 6 GDPR and the fulfillment of the principles in Art. 5 GDPR.

(2) The second condition considers the situation that in countries outside the EU/EEA the GDPR does not apply. The protection in the EU shall not be undermined by a transfer to a third country, Therefore, additional obligations have to be met to ensure the protection of the personal data being subject to a data transfer. These specific conditions can be found in chapter five. According to chapter five, a transfer of personal data is only allowed, if the third country offers a data protection level that is adequate to the level of data protection in the EU or an exception applies. The requirements for an adequate data protection level in the third country are described in Art. 45 et. seq.

Decisions[edit | edit source]

→ You can find all related decisions in Category:Article 44 GDPR

References[edit | edit source]