A cross-border data transfer under the GDPR is any sending of personal data to, or access to it from, a country outside the European Economic Area (EEA). It is lawful only if the destination holds a European Commission adequacy decision, or if you put safeguards such as standard contractual clauses in place. As of October 2026, 17 adequacy decisions are in force, the newest for Brazil (26 January 2026). The full list, with dates, is in the table below.
Get it wrong, and the consequences are severe. In May 2025, the Irish Data Protection Commission fined TikTok €530 million for transferring EEA user data to China without adequate protections. Two years earlier, in May 2023, Meta had been hit with the largest GDPR fine in history - €1.2 billion - for the same category of violation involving transfers to the United States.
What counts as a cross-border data transfer under GDPR
Chapter V of the GDPR (Articles 44-50) governs transfers of personal data to third countries - meaning any country outside the European Economic Area. The EEA includes all 27 EU member states plus Norway, Liechtenstein, and Iceland. A transfer occurs whenever personal data is sent to, accessed from, or stored in a location outside this zone.
For website owners, this happens more often than you might expect. If your site uses Google Analytics and the data is processed on servers in the United States, that is a transfer. If your customer support tool routes ticket data through a provider in India, that is a transfer. A developer in Brazil who opens your database remotely counts too. Even cookies set by third-party scripts hosted on non-EEA servers can trigger transfer obligations.
Article 44 GDPR sets the general principle: a transfer may only take place if the conditions laid down in Chapter V are met. There are three main routes to lawful transfers, each with distinct requirements and limitations.
Which Chapter V route a transfer takes
Route 1: adequacy decisions, the simplest path
An adequacy decision is a formal determination by the European Commission that a country's data protection framework provides a level of protection "essentially equivalent" to that guaranteed within the EU. When a country holds an adequacy decision, personal data can flow there as freely as it moves between EU member states - no additional safeguards required.
Article 45 GDPR sets out the criteria the Commission must assess: the rule of law, respect for human rights, relevant legislation, the existence and effective functioning of an independent supervisory authority, and the country's international commitments regarding data protection.
As of October 2026, the European Commission's list of adequacy decisions covers the following countries, territories and one international organisation:
| Country, territory or organisation | Adequacy status | Dates and notes |
|---|---|---|
| Andorra | Active | Kept after the review of 11 older decisions (report of 15 January 2024) |
| Argentina | Active | Kept after the January 2024 review |
| Brazil | Active | Adopted 26 January 2026, mutual with Brazil's own adequacy decision for the EU |
| Canada | Active (commercial organisations, under PIPEDA) | Kept after the January 2024 review |
| European Patent Organisation | Active | Adopted 15 July 2025, the first decision for an international organisation |
| Faroe Islands | Active | Kept after the January 2024 review |
| Guernsey | Active | Kept after the January 2024 review |
| Israel | Active | Kept after the January 2024 review |
| Isle of Man | Active | Kept after the January 2024 review |
| Japan | Active | First review report 4 April 2023, mutual adequacy arrangement in place |
| Jersey | Active | Kept after the January 2024 review |
| New Zealand | Active | Kept after the January 2024 review |
| Republic of Korea | Active | Adopted 17 December 2021, first review concluded 23 July 2026 |
| Switzerland | Active | Kept after the January 2024 review |
| United Kingdom | Active | Renewed 19 December 2025, valid until 27 December 2031 |
| United States | Active (DPF-certified companies only) | EU-US Data Privacy Framework adopted 10 July 2023, first review 9 October 2024, upheld by the General Court 3 September 2025 |
| Uruguay | Active | Kept after the January 2024 review |
Adequacy decisions are not permanent. The Commission must periodically review them, and it can amend, suspend, or withdraw a decision if conditions deteriorate. On 15 January 2024, it published its report on the first review of the 11 decisions adopted under the old Data Protection Directive, and all 11 remain on the list.
The EU-US Data Privacy Framework, upheld but still contested
The US adequacy decision deserves separate attention because of its complexity and political sensitivity. The EU-US Data Privacy Framework (DPF), adopted on 10 July 2023, is the third attempt at a stable legal basis for transatlantic data flows. Its predecessors - Safe Harbor (2000-2015) and Privacy Shield (2016-2020) - were both struck down by the Court of Justice of the European Union in the Schrems I and Schrems II rulings.
The DPF is built on Executive Order 14086, signed by President Biden in October 2022, which introduced the principles of necessity and proportionality into US signals intelligence law and established a Data Protection Review Court (DPRC) for EU citizens to challenge surveillance activity. US companies must self-certify their participation in the framework through the Department of Commerce. By the time of the first periodic review in July 2024, more than 2,800 companies had joined - 70% of them small and medium-sized businesses.
The European Commission's October 2024 review report concluded the framework was functioning effectively. The EDPB's own November 2024 report largely concurred, but raised concerns about oversight of onward transfers and monitoring of compliance by US entities.
In January 2025, President Trump dismissed the three Democratic members of the Privacy and Civil Liberties Oversight Board (PCLOB), one of the oversight bodies the Commission relied on in its adequacy decision, which left the board without a quorum. Critics argued that this weakened the framework's safeguards.
The first court test came on 3 September 2025. In Latombe v Commission (T-553/23), the EU General Court dismissed an action to annul the DPF and confirmed that, when the decision was adopted, the United States ensured an adequate level of protection for data sent to certified organisations. As of October 2026, an appeal (C-703/25 P) is pending before the Court of Justice, so a "Schrems III" ruling remains possible.
The DPF remains in force. For website owners relying on US-based services, the practical advice is straightforward: check that your US service providers appear on the Data Privacy Framework list, and keep Standard Contractual Clauses in place as a fallback.
The UK adequacy decision, renewed until 2031
The United Kingdom received its original adequacy decision in June 2021, following Brexit. That decision was set to expire in June 2025. After a six-month technical extension, the Commission renewed UK adequacy on 19 December 2025, and the renewed decisions run until 27 December 2031.
The EDPB's October 2025 opinion supported the renewal, concluding that the UK's data protection regime remains essentially equivalent to the GDPR. It did, however, flag concerns about the UK's evolving surveillance laws, the Data (Use and Access) Act, and the broader discretion given to the Secretary of State to alter transfer rules through secondary legislation. The EDPB recommended ongoing monitoring.
For practical purposes, UK adequacy means your website can transfer data to UK-based processors without additional safeguards - but this is a space worth watching as the UK continues to diverge from EU data protection standards.
Route 2: standard contractual clauses (SCCs)
When no adequacy decision covers the destination country, the most commonly used safeguard under Article 46 GDPR is Standard Contractual Clauses. SCCs are pre-approved contractual templates issued by the European Commission that impose binding data protection obligations on both the data exporter (in the EEA) and the data importer (outside the EEA).
The current SCC framework, adopted in June 2021, replaced the older 2001/2010 clauses and introduced a modular structure with four distinct configurations:
| Module | Transfer scenario | Common example |
|---|---|---|
| Module 1 | Controller to Controller | Sharing customer data with a non-EEA business partner |
| Module 2 | Controller to Processor | Using a non-EEA cloud hosting or analytics provider |
| Module 3 | Processor to Processor | Your EU processor engaging a sub-processor outside the EEA |
| Module 4 | Processor to Controller | A non-EEA entity retrieving data it controls from an EEA processor |
Choosing the wrong module is a common mistake. If your analytics provider in the US engages a sub-processor in Singapore, Module 3 applies to that second hop - not Module 2.
SCCs are not a rubber stamp. Since the Schrems II ruling in July 2020, anyone relying on SCCs must also conduct a Transfer Impact Assessment (TIA). A TIA requires you to evaluate the laws and practices of the destination country - particularly regarding government access to data - and determine whether the SCCs alone provide sufficient protection. If they do not, you must implement supplementary measures such as encryption, pseudonymisation, or contractual restrictions on data access. The method is set out in the EDPB Recommendations 01/2020 on supplementary measures.
The TikTok decision, covered in the enforcement section below, shows what happens when this assessment is missing.
Route 3: binding corporate rules (BCRs)
Binding Corporate Rules are internal data protection policies adopted by multinational corporate groups to govern transfers of personal data within the organisation. Under Article 47 GDPR, BCRs must be approved by the competent supervisory authority and must include legally binding obligations on every member of the group.
BCRs are powerful but resource-intensive. The approval process, though simplified somewhat in recent years, still involves detailed documentation, a consistency mechanism across multiple DPAs, and ongoing monitoring. They are typically used by large enterprises - companies like Accenture, Siemens, and Unilever - rather than small or mid-sized website operators.
If your organisation operates across multiple countries and regularly transfers employee or customer data between subsidiaries, BCRs can provide a single, unified framework for those transfers. For most website owners, SCCs are the more practical option.
Derogations: limited exceptions under Article 49
Article 49 GDPR provides a narrow set of derogations that allow one-off transfers without an adequacy decision or safeguards. These include explicit consent of the data subject, transfers necessary for the performance of a contract, and transfers necessary for important reasons of public interest.
These derogations are narrow by design. The EDPB has repeatedly stated that they cannot be used to justify regular, systematic data flows. If you are transferring analytics data to a US provider on every page load, Article 49 consent is not a viable basis - you need an adequacy decision or SCCs.
Enforcement is intensifying: lessons from Meta and TikTok
Two enforcement actions have set the pattern for cross-border transfer cases.
In May 2023, the Irish DPC fined Meta €1.2 billion for transferring EU Facebook user data to the United States using SCCs, following the CJEU's Schrems II ruling. The EDPB's binding decision found Meta's infringement "very serious" given the systematic, repetitive, and continuous nature of the transfers and the volume of data involved. Meta was ordered to suspend transfers within five months and bring processing into compliance within six months. The case was resolved in practice by the adoption of the EU-US Data Privacy Framework in July 2023, which Meta promptly joined.
In May 2025, TikTok received a €530 million fine - the third-largest in GDPR history - for transferring EEA user data to China: €485 million under Article 46(1) and €45 million for failing to explain the transfers under Article 13(1)(f). The DPC found that TikTok had relied on SCCs but failed to conduct the assessments required by the Schrems II ruling. A particularly damaging revelation emerged during the investigation: TikTok had told the DPC that it did not store EEA data on Chinese servers, then informed it in April 2025 that limited EEA data had in fact been stored there, acknowledging that its earlier statements were inaccurate.
The signal from both cases is clear. Regulators expect data exporters to actively verify that their safeguards work. Signing SCCs is not enough. You must assess the destination country's laws, implement supplementary measures where needed, and be transparent with both regulators and data subjects about where data goes.
What this means for website owners
If your website uses any third-party service that processes personal data outside the EEA, you are making cross-border transfers and Chapter V of the GDPR applies to them. These steps cover the usual cases.
Map your data flows. Identify every service, cookie, and script that sends personal data outside the EEA. This includes analytics platforms, advertising pixels, customer chat widgets, CDN providers, email marketing tools, and payment processors. Kukie.io's free Script audit lists every third-party domain a page loads and the service behind each one, and its cookie scanner finds the third-party cookies those scripts set.
Check the legal basis for each transfer. For each destination country, determine whether an adequacy decision exists. If you transfer data to the US, verify that the recipient company is listed on the Data Privacy Framework website. If no adequacy decision applies, put SCCs in place with the correct module selected.
Conduct Transfer Impact Assessments. For any transfer relying on SCCs, assess whether the laws of the destination country could undermine the protections the clauses provide. Pay particular attention to government surveillance powers and whether law enforcement can compel access to personal data without equivalent judicial oversight.
Implement supplementary measures where needed. If your TIA reveals risks, add technical safeguards. Encryption of data in transit and at rest, pseudonymisation before transfer, and contractual restrictions on sub-processing are all recognised supplementary measures.
Update your privacy notice. Article 13(1)(f) GDPR requires you to inform data subjects about transfers to third countries, including the safeguards relied upon. TikTok's €45 million transparency fine shows that vague or incomplete disclosure is a standalone violation. Name the countries, specify the safeguard mechanism, and link to the relevant SCC or adequacy decision.
Review your cookie consent mechanism. If third-party cookies trigger cross-border transfers, those cookies must be blocked until the user gives informed consent - unless they fall under the strictly necessary exemption. Your cookie consent banner should make clear which cookies involve international transfers and to which countries.
Where cross-border transfers are heading
The list keeps growing. Brazil received its adequacy decision on 26 January 2026, opening the door to freer data flows with the largest market in Latin America, and Brazil recognised the EU in return. The European Commission also granted its first-ever adequacy decision to an international organisation - the European Patent Organisation - on 15 July 2025, setting a precedent for non-state entities.
At the same time, the legal basis for US transfers is still before the courts. The EDPB has also adopted guidelines on Article 48 GDPR, clarifying how controllers should respond to requests from foreign authorities that conflict with EU law.
For website owners, the practical takeaway is to build flexibility into how you handle transfers. Adequacy decisions can be withdrawn. SCCs require ongoing assessment. The EU-US Data Privacy Framework, while functional today, rests on executive orders that a future administration could modify. Having more than one transfer mechanism in place - and documenting your reasoning for each - is not paranoia. It is prudent risk management.
Questions about GDPR data transfers
Do I need to worry about cross-border data transfers if I only use cookies on my website?
Yes. If any of those cookies are set by third-party services hosted outside the EEA - such as Google Analytics, Meta Pixel, or a live chat tool - then a cross-border transfer is taking place every time data is collected. You need a legal basis for each transfer under GDPR Chapter V.
Is Google Analytics still legal to use in the EU after the Schrems II ruling?
Google is certified under the EU-US Data Privacy Framework, which currently provides a valid legal basis for transfers to the US, and the EU General Court upheld the framework in September 2025. The transfer relies on Google keeping its DPF certification, so check the Data Privacy Framework list and note it in your privacy policy. Analytics cookies still need consent under the ePrivacy rules.
What happens if the EU-US Data Privacy Framework is invalidated?
If the DPF is struck down by the CJEU - as happened with Safe Harbor and Privacy Shield - organisations would need to fall back on alternative mechanisms such as Standard Contractual Clauses. Keep SCCs in place with US providers even if you currently rely on the DPF, so you are not caught without a legal basis if the framework collapses.
How do I conduct a Transfer Impact Assessment for my website?
A TIA involves identifying the destination country for each data transfer, reviewing its surveillance and data access laws, assessing whether those laws could undermine the protections in your SCCs, and documenting any supplementary measures you adopt. The EDPB's recommendations on supplementary measures (adopted June 2021) provide a step-by-step methodology.
Can I rely on user consent to transfer data outside the EEA?
Article 49(1)(a) GDPR allows transfers based on explicit consent, but only for occasional, non-systematic transfers. If your website routinely collects analytics or advertising data that flows to a non-EEA country on every page view, consent under Article 49 is not a valid basis. You need an adequacy decision or appropriate safeguards like SCCs.
Does the UK still have an adequacy decision after Brexit?
Yes. The European Commission renewed the UK's adequacy decisions on 19 December 2025, and they now run until 27 December 2031. Data can flow from the EEA to the UK without additional safeguards while the decisions remain in force.
What is the difference between SCCs and BCRs for international data transfers?
Standard Contractual Clauses are pre-approved contract templates used between a data exporter and a specific data importer for individual transfer relationships. Binding Corporate Rules are internal policies adopted by multinational groups to govern transfers within the corporate family. SCCs are simpler and more widely used, while BCRs require supervisory authority approval and are typically adopted by large enterprises.
See which of your cookies leave the EEA
If you are not sure which cookies on your site send data abroad, a free cookie scan lists the first-party and third-party cookies your pages set and the domains behind them. Kukie.io can then hold those cookies until visitors consent, and you can name each provider's country in your privacy notice.
