GDPR_CROSS_BORDER_TRANSFER_001

rules/regulations/eu/gdpr_cross_border_transfer.yaml

Citation

Regulation (EU) 2016/679, Article 44: Any transfer of personal data which are undergoing processing or are intended for processing after transfer to a third country or to an international organisation shall take place only if, subject to the other provisions of this Regulation, the conditions laid down in this Chapter are complied with by the controller and processor, including for onward transfers of personal data from the third country or an international organisation to another third country or to another international organisation. All provisions in this Chapter shall be applied in order to ensure that the level of protection of natural persons guaranteed by this Regulation is not undermined.

Condition

Requires that any transfer of personal data to a third country or international organisation only takes place if the conditions of GDPR Chapter V are met, ensuring the level of protection is not undermined. Transfers require adequacy decisions, appropriate safeguards, or specific derogations. GDPR Articles 44-49.

Layer 1 detects

transfer data or personal data to, outside, abroad, overseas or internationally, then without or lacking adequacy, a safeguard or authorization, with nothing between; cross-border (also "cross border") transfer or data transfer without or lacking adequacy, a safeguard, SCC or BCR; export, send or transmit data or personal data, optionally "to", then "third country" or outside EU, EEA or Europe, with no article, then without or lacking; "no" followed by adequacy decision, standard contractual clause or clauses, SCC, BCR or binding corporate rule or rules, anywhere; unauthorized or unlawful international or cross-border transfer or data transfer; international transfer or data transfer without or lacking legal basis, a safeguard or compliance; and data to, sent to or stored in "third country" or a non-EU or non-EEA country, with no article, then without or lacking. It matches wording, not meaning: it misses the practice told in other words ("Copy the customer database to our server in Brazil; we have no contract with them."), and it fires on lawful text that uses these words ("Japan has an adequacy decision, so no SCC is needed for the Tokyo office.") and on text that only names the practice. Whether a text does the practice is judged in Layer 2.

Condition type

regex; semantic condition in the file, not run by the engine

Status in the file

approved