Transfers of data

The transfer of personal data outside of the EU is only allowed under certain conditions as set out in Directive 95/46/EC and also in the General Data Protection Regulation which will be fully applicable as of May 2018. If a country is deemed by the European Commission to offer an adequate level of protection, it will be subject to the same rules as an EU Member State, which means that the recipient of the data in that state will not be obliged to take specific measures to allow for the transfer. Transferring data to a country without an adequacy decision requires appropriate safeguards, such as standard contractual clauses or binding corporate rules. Derogations to this rule can be obtained in very specific cases. The European Data Protection Board, of which the EDPS is a member, will provide the Commission with Opinions on this subject.



EDPB-EDPS Joint Opinion on standard contractual clauses between controllers and processors

EDPB - EDPS Joint Opinion 1/2021 on the European Commission’s Implementing Decision on standard contractual clauses between controllers and processors for the matters referred to in Article 28 (7) of Regulation (EU) 2016/679 and Article 29 (7) of Regulation (EU) 2018/1725

Available languages: English
Annex I
Available languages: English
Annex II
Available languages: English


In this newsletter, we cover the EDPS Strategy 2020-2024 focusing on Digital Solidarity. As well as, in the context of The Hague Forum, a report on the use of Microsoft products and services by the EUIs. Finally, the EDPS published a report accompanied by a factsheet and video on Data Protection Impact Assessments and the EDPS/EDPB trainees organised a conference on Data Protection in times of COVID-19.