How can personal data be transferred from the EU to the United States lawfully?

• EU

  Articles 44 to 49 set the order: adequacy first, then safeguards such as the standard contractual clauses with supplementary measures, and only then the derogations in Article 49, which are occasional by design.

  Commission Implementing Decision (EU) 2021/914 · Europeiska kommissionen

• United States

  The recipient must be certified under the Data Privacy Framework for the adequacy route, and certification is checked on the official list, not on a claim in a contract.

  Commission Implementing Decision (EU) 2023/1795 · Europeiska kommissionen

• Sweden

  The Authority for Privacy Protection supervises the exporter in Sweden, and the assessment behind the transfer is part of the accountability documentation.

  SFS 2018:218 · Sveriges riksdag

• Norway

  The same chapter applies through the EEA, and Datatilsynet supervises the Norwegian exporter.

  LOV-2018-06-15-38 · Lovdata

• Germany

  German state authorities have taken an active line on transfer assessments, and documentation of supplementary measures is expected at inspection.

  BDSG 2018 · Bundesministerium der Justiz

• Article 45: transfer without further authorisation where the Commission has decided the level of protection is adequate.
• Article 46: appropriate safeguards, including the standard contractual clauses, with enforceable rights for the individual.
• Article 49: derogations for specific situations, read narrowly and not as a standing basis for routine transfers.

Record which route each transfer uses, keep the certification check or the clauses with the assessment in the same file, and revisit it when the recipient or the sub-processor changes.

The privacy notice must state that data goes to a third country and on what basis, and you can ask for a copy of the safeguards relied on.

Check the recipient's certification and the module of the clauses in the same review, because the wrong module is the most common defect in a transfer file.

All global questions