Third country

In data protection law, a third country is a country outside the European Union (EU) and the European Economic Area (EEA). Where personal data is transferred from the European data protection area to recipients in a third country, specific requirements under the General Data Protection Regulation (GDPR) apply. Articles 44 to 49 GDPR govern the conditions under which such data transfers are permitted.

What is a third country under the GDPR?

Under European data protection law, third countries are countries that are neither members of the European Union nor part of the European Economic Area.

In addition to the EU Member States, the European Economic Area includes Iceland, Liechtenstein and Norway. Data transfers between these countries are therefore not subject to the specific requirements for transfers to third countries under Chapter V GDPR.

Examples of third countries include:

• USA: The United States is not a member of the EU or the EEA. An adequacy decision applies to certain certified US companies under the EU-US Data Privacy Framework.
• Switzerland: Switzerland is not part of the EEA but is covered by an adequacy decision issued by the European Commission.
• United Kingdom: Since Brexit, the United Kingdom has been treated as a third country for data protection purposes. An adequacy decision issued by the European Commission applies to the country.
• China: China is a third country for which the European Commission has not issued a general adequacy decision.

Adequacy decisions also exist for other countries, including Japan, South Korea, Canada and Brazil. Their scope may vary depending on the country and recipient concerned.

Being classified as a third country does not automatically mean that a data transfer is prohibited. What matters is whether the statutory requirements for transferring personal data are met.

When does a transfer of data to a third country take place?

A transfer to a third country generally occurs where a controller or processor subject to the GDPR transfers personal data to another controller or processor in a third country, or makes such data accessible to that recipient.

A physical transfer of data is not required. Access to personal data from a third country may also constitute a transfer to a third country if the data is made accessible to a recipient established there.

Typical examples include:

• A German company transfers customer data to a service provider in the USA.
• A cloud provider allows its support staff in India to access the personal data of European customers, thereby making the data accessible to a service provider established there.
• A company uses a software solution through which personal data is disclosed to an external provider in a third country.

The location of the servers is not the only relevant factor. Access rights and the companies involved must also be taken into account.

However, not every connection with a foreign country automatically constitutes a transfer to a third country within the meaning of Chapter V GDPR. For example, if an employee of a German company accesses their employer's systems from a third country while on a business trip, purely internal access does not, by itself, constitute a transfer to another recipient.

Companies must therefore examine the actual data flows and recipients involved in their processing activities.

Under what conditions may personal data be transferred to third countries?

A transfer of personal data to a third country is only permitted if, in addition to the general requirements of the GDPR, the specific requirements of Chapter V are also met.

The GDPR provides for three main mechanisms:

1. Adequacy decision under Article 45 GDPR

The European Commission may determine that a third country, a territory or a specific sector ensures an adequate level of data protection.

Where a relevant adequacy decision exists, personal data may generally be transferred without additional transfer safeguards under Chapter V. All other GDPR requirements continue to apply.

It should be noted that adequacy decisions do not necessarily cover all recipients or processing activities in a country. Their respective scope must therefore be checked.

2. Appropriate safeguards under Article 46 GDPR

If no relevant adequacy decision exists, a transfer may be based on appropriate safeguards. In business practice, the following instruments are particularly important:

• Standard Contractual Clauses (SCCs): Contractual clauses adopted by the European Commission to protect personal data in international transfers.
• Binding Corporate Rules (BCRs): Approved data protection rules for certain intra-group transfers of personal data.

Article 46 GDPR also provides for other options, including certain arrangements between public authorities and bodies, as well as approved codes of conduct or certification mechanisms accompanied by binding commitments from data recipients.

When using Standard Contractual Clauses, companies must assess whether they can be effectively complied with in the specific third country. This includes, in particular, assessing the laws applicable there and the actual circumstances of the transfer. Additional safeguards may be necessary.

3. Derogations under Article 49 GDPR

If neither an adequacy decision nor appropriate safeguards are available, a transfer to a third country may still be permitted in certain exceptional circumstances.

Subject to the applicable statutory conditions, these include, for example, explicit consent after the data subject has been informed of the possible risks, certain transfers necessary for contractual purposes, important reasons of public interest,

or the establishment, exercise or defence of legal claims.

Other narrowly defined derogations concern, among other things, vital interests, certain transfers from public registers and specific situations involving compelling legitimate interests.

These derogations must be interpreted narrowly and do not generally replace the need for a permanent safeguard for regular data transfers.

A legal basis for the processing of personal data, for example under Article 6 GDPR, remains necessary regardless of the transfer mechanism selected.

What specific requirements apply to data transfers to the USA?

For data protection purposes, the USA is a third country. However, the EU-US Data Privacy Framework (DPF) provides a specific basis for certain data transfers.

In July 2023, the European Commission adopted an adequacy decision for the USA under the EU-US Data Privacy Framework. This covers transfers of personal data to US companies that are appropriately certified under the Framework and fall within the scope of the decision.

Before transferring data, companies must therefore check whether the relevant US recipient holds a valid certification and whether that certification covers the processing in question.

This certification can be checked using the official list at www.dataprivacyframework.gov.

If a US company is not appropriately certified, a data transfer may, for example, be based on Standard Contractual Clauses. In this case, the requirements of Article 46 GDPR must be met, including the necessary assessment of the level of protection.

The adequacy decision for the EU-US Data Privacy Framework therefore does not remove the need to check the specific recipient. Companies should also bear in mind that the legal framework governing international data transfers may change as a result of court decisions or new adequacy decisions.

What obligations and risks apply to transfers to third countries?

Companies must assess international data transfers under data protection law before carrying them out and ensure compliance with the statutory requirements.

The following measures are particularly important:

• Identify data flows: Determine which personal data is transferred, to which recipients and to which countries.
• Check the transfer mechanism: Establish whether an adequacy decision, appropriate safeguards or a statutory derogation applies.
• Assess the level of protection: Where transfers are based on appropriate safeguards, assess whether the required level of protection can actually be ensured.
• Meet contractual requirements: Where processing is carried out on behalf of a controller, conclude a data processing agreement under Article 28 GDPR where required.
• Inform data subjects: Disclose transfers to third countries and the relevant safeguards in accordance with the transparency obligations under Articles 13 and 14 GDPR.
• Document the assessment: Keep a clear record of the decisions made and the safeguards implemented.

An unlawful transfer to a third country may result in supervisory measures under Article 58 GDPR and administrative fines under Article 83(5)(c) GDPR.

The statutory maximum administrative fine is up to EUR 20 million or, in the case of an undertaking, up to 4% of its total worldwide annual turnover for the preceding financial year, whichever is higher.

Companies should therefore not assess international data transfers solely by reference to server locations. They must also take into account all recipients involved, access possibilities and legal grounds for the transfer.

Practical example: Using a US-based cloud service

A German company intends to use a US-based cloud service to manage its customer data. The personal data is stored on servers within the European Union. However, the US provider may access this information as part of its technical support services.

The company first assesses whether access by the US provider constitutes a transfer to a third country. It then checks whether the provider holds a valid certification under the EU-US Data Privacy Framework and whether the relevant service falls within the scope of that certification.

If so, the transfer may be based on the corresponding adequacy decision. Additional safeguards through Standard Contractual Clauses are generally not required for this transfer on account of its third-country element.

Regardless, the company checks compliance with the general GDPR requirements, concludes an appropriate agreement where processing is carried out on behalf of a controller, and informs data subjects about the processing.

If no relevant certification exists, the company assesses alternative transfer mechanisms and any additional safeguards that may be required.

legal data assessment: For transfers to third countries, the location of the servers is not the only relevant factor. Companies must also take into account potential access from abroad and the legal status of the service providers involved. A careful assessment of the transfer mechanism is particularly important when using cloud services and software deployed internationally. Documenting data flows and safeguards reduces the risk of unlawful transfers of personal data.

Legal bases

Article 6 GDPR; Articles 13 and 14 GDPR; Article 28 GDPR; Articles 44 to 49 GDPR; Articles 58 and 83 GDPR.