GDPR Chapter V, Articles 44 to 49: when a data flow is a transfer, adequacy decisions including the EU-US Data Privacy Framework, standard contractual clauses and supplementary measures, binding corporate rules, foreign authority requests and derogations.
Transfers to countries the Commission has found adequate, which need no further authorization: how adequacy is assessed and reviewed, the current list as of October 2026, and monitoring that a decision stays valid.
The adequacy decision for US organizations that self-certify to the Data Privacy Framework: scope, the Commission's first review, the General Court judgment upholding it and the pending appeal, as of October 2026.
The safeguards that allow transfers without an adequacy decision: Commission and authority clauses, binding corporate rules, codes of conduct, certification, and ad hoc clauses that need authorization, plus the requirement of enforceable rights.
The Commission's 2021 standard contractual clauses for transfers: the four modules, the Clause 14 assessment of local laws, handling public authority requests under Clause 15, and the technical measures annex.
The EDPB's six-step method for transfers under Article 46 tools: mapping transfers, assessing third-country law, and technical measures such as encryption with exporter-held keys, including the cases where no technical measure works.
Group-wide binding rules approved by a supervisory authority for intra-group transfers: approval through the consistency mechanism, required content including audits and training, and the EDPB controller and processor recommendations.
Why a foreign court order or authority request alone does not make a transfer lawful, the role of mutual legal assistance treaties, and the related exposure when EU-based providers are subject to third-country laws.
Transfers without adequacy or safeguards in limited situations such as explicit consent, contract necessity and legal claims, the narrow compelling-legitimate-interests fallback, and why derogations cannot support regular transfers.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.