International transfers, described mechanically
Storage location does not decide this. A database in Frankfurt that a vendor's support engineer in a non-adequate country can query is a transfer, because making personal data available to a separate organisation outside the EEA counts whether or not a byte is copied. Your own employee logging in from the same country is not a transfer, on the EDPB's reading, though the access still has to be secured. Teams routinely produce a hosting diagram as evidence of compliance and omit the access list, which is the part a reviewer checks first. The legal instruments matter, and the access boundary is what makes them true.
What counts as a transfer?
Three things have to be true at once, on the EDPB's reading in Guidelines 05/2021: you are subject to the GDPR for the processing, you disclose the data or otherwise make it available to another controller, joint controller or processor, and that recipient is in a third country. Remote access is enough to make the data available, so no copy needs to be made and no data needs to leave the region.
The criterion that gets missed is the separate recipient. A third country parent company reading a shared dashboard is a transfer, so is a vendor whose own staff can access the environment they operate for you, and so is an offshore development team engaged through their own company. Your own employee logging in from a third country is not, because Example 5 of those guidelines treats an employee as an integral part of the controller rather than a separate recipient. That access still has to be secured under Articles 5(1)(f), 24 and 32, and the EDPB expects the exposure to third country law to be addressed, but it does not need an Article 46 instrument.
The UK operates its own version of this regime with its own list of countries and its own instruments, so a transfer from the UK and a transfer from the EU are two separate assessments even when the destination is identical. Other jurisdictions add their own residency and transfer rules, and where you serve several, the constraint is the intersection rather than the average.
One thing that is not a transfer basis: a demand from a foreign court or authority. Article 48 means an order from a third country is not on its own a lawful route for disclosure, which is why a request for customer data from a non-EU authority is a legal question for counsel and not an operational one for an engineer to answer at speed.
Which mechanism applies to which situation?
Chapter V provides a short list, and the correct one depends on the destination and the parties rather than on convenience. Adequacy is the simplest where it exists. Article 46 instruments carry an assessment obligation. The derogations in Article 49 are for genuinely occasional cases and are not an architecture.
| Mechanism | When it applies | What it requires of you | Where it is weak |
|---|---|---|---|
| Adequacy decision, Article 45 | Destination country or framework is recognised | Confirm the recipient is genuinely covered | Can be reviewed, narrowed or withdrawn |
| Standard contractual clauses, 46(2)(c) | Most commercial vendor relationships | Correct module, plus a transfer impact assessment | Clauses cannot bind a third country's authorities |
| UK IDTA or UK Addendum | Transfers out of the UK | A separate UK transfer risk assessment | Two parallel assessments for one data flow |
| Binding corporate rules, Article 47 | Large groups moving data internally | Regulator approval, which takes a long time | No help for third party vendors |
| Derogations, Article 49 | Occasional, non-repetitive transfers | A documented case for each occurrence | Not available for systematic processing |
| Keep the data in region | Where the flow is not actually necessary | Region pinning and an access boundary | Constrains hiring and on-call design |
What does a transfer impact assessment involve?
Assessing whether the instrument you signed can actually be honoured in the destination country, which is what the Schrems II judgment requires and what the EDPB recommendations describe. The analysis looks at the laws in the recipient country that could compel access to the data, whether the recipient is subject to them, what the data is and how sensitive, and whether supplementary measures reduce the exposure to an acceptable level.
The output is a document with a conclusion and it has to be honest about the residual risk, because a boilerplate assessment concluding that everything is fine is worse than no assessment at all. It is also a living document: it should be revisited when the vendor changes sub-processors, when the data categories change, or when the legal position in the destination country moves.
Supplementary measures are where engineering contributes. Encryption only helps if the recipient cannot decrypt, which means key custody must stay in region and the importer must never hold plaintext or keys. If your vendor processes the data, encryption in transit and at rest under their key does not answer the question, and claiming otherwise is the most common error in these assessments.
How stable are the frameworks you rely on?
Less stable than an architecture should assume. Two adequacy arrangements covering US transfers have been struck down in the past, and the current framework for transfers to self-certified US organisations remains subject to periodic review and to legal challenge. Whether it survives is not something anyone can promise, and a design that fails entirely if it is withdrawn is a design with a single point of legal failure.
The way to build for this is to make the fallback cheap rather than to predict the outcome. If a transfer relies on a framework today, know which Article 46 instrument would replace it, whether the vendor offers a regional deployment, and how long a migration would take. Recording that answer per vendor turns a legal shock into a planned change.
Also check the specifics rather than the headline. Where a framework covers self-certified organisations, the recipient entity must actually appear on the relevant list, the certification must be current, and some categories of data are only covered where the organisation has elected to include them. A vendor asserting participation is not the same as a vendor being covered for the data you are sending.
What controls make a transfer claim true?
Region pinning across every dependency, an access boundary that reflects geography, and a record of both. Region pinning means naming the region for each managed service, CDN log destination, error tracker, log platform, backup target and queue, and verifying it rather than assuming the console default. In a container estate this extends to registry region, snapshot location and any injected agent's reporting endpoint.
The access boundary is the harder half. Production access should be granted through an identity system that knows where the person is, mediated by a jump host or a session broker with recording, and scoped so that a support case can be resolved without reading raw personal data. Masked views and purpose-limited query tools do more for a transfer position than any additional paperwork.
Then keep the record. A list of every human and service principal with access to personal data, their location and their justification, reviewed on a schedule, is the evidence a reviewer wants and the artefact that reveals the problem. Most organisations discover their real transfer picture the first time they produce it.
What should you check this week?
Query your identity provider for every account with production data access and list the country each person works from. Then list every service principal, integration and vendor support account with the same access. Split the result into your own employees and separate recipients, because only the second group needs a Chapter V mechanism, and compare that group against the mechanisms you have in place. The gap is normally one or two categories: contractors engaged through their own company in a third country, and a vendor whose support team is global.
Second, take one flow and follow it to the end. Pick your error tracking. Where does an exception payload go, which region receives it, who at the vendor can read it, which sub-processors do they use, and what instrument covers it. This single exercise usually surfaces both a transfer with no mechanism and a payload containing more personal data than anyone expected.
Third, decide which flows should simply stop. A transfer that exists because a tool was convenient is cheaper to remove than to document, and every removal is one fewer assessment to maintain and one fewer thing to explain when the legal landscape shifts again.
Common questions
- Is remote access from another country a data transfer?
- It depends who is accessing. Making personal data available to a separate organisation outside the EEA is a transfer even if the data stays in a European data centre and no copy is made, so a vendor's staff administering your environment, a third country parent company reading a dashboard, or an offshore team engaged through their own company all fall within Chapter V. Your own employee querying the database from a third country does not, because the EDPB treats an employee as part of the controller rather than a separate recipient, though Articles 5(1)(f), 24 and 32 still govern that access. Either way a hosting diagram is not evidence of compliance and an access list is.
- What is a transfer impact assessment?
- The analysis required when relying on an Article 46 instrument such as standard contractual clauses: whether the clauses can actually be honoured in the destination country. It examines the laws that could compel access to the data, whether the recipient is subject to them, the sensitivity of the data, and whether supplementary measures reduce the risk enough. The UK requires its own equivalent assessment for transfers out of the UK.
- Does encryption solve international transfer problems?
- Only when the recipient cannot decrypt. Encryption counts as a supplementary measure where the importer never holds plaintext and never holds the keys, with key custody remaining in the exporting region. If the vendor processes the data, they need plaintext, and encryption at rest under their own key does not address the risk the assessment is about. Treating it as though it does is the most common error in these assessments.
- Can you rely on a foreign court order to disclose personal data?
- Not on its own. Article 48 provides that a judgment or decision of a third country authority is not a lawful basis for transfer unless it operates through an international agreement such as a mutual legal assistance treaty. A request from a non-EU authority is therefore a question for counsel rather than something to action operationally, and the response route should be agreed before such a request arrives.
- How should you prepare for an adequacy framework being withdrawn?
- Make the fallback cheap instead of predicting the outcome. For each vendor relying on a framework, record which Article 46 instrument would replace it, whether a regional deployment is available, and how long a migration would take. Two previous arrangements covering US transfers were struck down, so a design that fails entirely without the current one has a single point of legal failure worth removing.
