EU Data Transfers for Non-EU Companies — SCCs, Adequacy, and Compliance

GDPR Chapter V (Articles 44-49) governs transfers of personal data from the EU to third countries. For non-EU businesses receiving EU personal data, understanding these rules is essential — especially after the Schrems II ruling (2020) and ongoing developments.

Transfer Mechanisms Under GDPR

To lawfully transfer EU personal data to a non-EU country, you need one of the following:

• Adequacy decision: The European Commission has determined that the destination country provides an “adequate level of data protection.” 16 countries have adequacy: Andorra, Argentina, Canada (commercial), Faroe Islands, Guernsey, Israel, Isle of Man, Japan, Jersey, New Zealand, Republic of Korea, Switzerland, UK, Uruguay, plus limited US adequacy under the Data Privacy Framework (DPF).
• Standard Contractual Clauses (SCCs): The most common mechanism. EU-approved contract terms between data exporter and importer. Requires a Transfer Impact Assessment (TIA) and supplementary measures for non-adequate countries.
• Binding Corporate Rules (BCRs): For intra-group transfers within multinational corporations. Requires DPA approval.
• Derogations (Article 49): Explicit consent, contract necessity, vital interests — limited situations only.

Schrems II and III

The Schrems II ruling (July 2020) invalidated the EU-US Privacy Shield framework and mandated TIAs for SCC-based transfers. It also required supplementary measures where local law impairs the protections of SCCs.

Schrems III (2024) reinforced these requirements, specifically addressing transfers to “surveillance-heavy” jurisdictions. EU DPAs increasingly scrutinise transfer mechanisms used by non-EU businesses — particularly for US-based companies using SCCs without proper TIAs.

Data Privacy Framework (DPF) 2023

The EU-US Data Privacy Framework, adopted July 2023, provides an adequacy basis for certified US companies. Key limitation: only covers US entities that self-certify under the DPF. Uncertified US businesses must use SCCs or other mechanisms.

How Your EU Representative Fits In

Your EU Representative is the point of contact for data subjects and DPAs regarding transfer mechanisms. They maintain records of SCCs, TIAs, and adequacy assessments as part of your ROPA. Get your EU Rep from EUR 490/year →