Where standard contractual clauses (SCCs) are relied on, what are the obligations on (and risks to) organisations receiving personal data as part of an international transfer of personal data governed by the EU GDPR?

This Q&A assumes that:

1. •

   personal data is being transferred by an entity in the EU, which offers goods/services to or monitors the behaviour of data subjects in the EU (and that the EU’s General Data Protection Regulation, Regulation (EU) 2016/679 (EU GDPR) applies)

2. •

   personal data is being received by an entity in a jurisdiction other than the EEA

3. •

   the movement of data in question falls within the category of international transfers restricted by Article 44 of the EU GDPR

The issue of international transfers of personal data is a complex one; this answer summarises some of the main legal points relevant to the question and signposts other materials which should be consulted (along with relevant legislation and regulatory guidance) for further details. Those new to data protection law may wish to start by reading: EU GDPR regime (EU Law)—overview and International transfers (EU Law)—overview.

Chapter