Legal basis for the transfer
What is required to move personal data out of the jurisdiction?
EU
Dataskyddsförordningen
art. 44 till 46
A transfer to a third country requires an adequacy decision or appropriate safeguards, in practice the Commission's standard contractual clauses.
- Deadline
- Before the transfer begins
- Penalty
- Up to EUR 20 million or four percent of global turnover
- Supervision
- Integritetsskyddsmyndigheten och EDPB
- Read
- 2026-08-22
United States
California Consumer Privacy Act, som ändrad genom CPRA
Cal. Civ. Code § 1798.100(d)
Federal law does not restrict the transfer as such. State law requires a contract with the recipient binding purpose and onward transfer.
- Deadline
- Before the transfer begins
- Penalty
- Civil penalty per violation
- Supervision
- California Privacy Protection Agency och delstatens justitiekansler
- Read
- 2026-08-22
China
Personal Information Protection Law
art. 38 och 39
An outbound transfer requires one of three routes: a CAC security assessment, certification or the Chinese standard contract, plus separate consent from the individual.
- Deadline
- Before the transfer begins
- Penalty
- Up to CNY 50 million or five percent of the previous year's turnover
- Supervision
- Cyberspace Administration of China
- Read
- 2026-08-22
Connections
Sources and review
Register version crossover-v1.0.0 · Read 2026-08-22
This page restates written law with the provision and the official source. It is not legal advice in an individual matter.
Next step
Three ways to put the register to work in your own practice.
Start with your task
Litigation
Find support in a judgment
Search guiding decisions, see what became final and follow changes in the law.
In-house, deals
Map the rules in a transaction
Move from theme to act and on to the article that carries the duty.
Compliance
Assess the risk in a process
Risk scoring per legal area, with the sources behind every score.