GDPR Article 44 (International Data Transfers)

Chapter V of the EU General Data Protection Regulation (Articles 44-50) governs every transfer of personal data outside the European Economic Area (EEA). Article 44 is the chapter’s foundational provision: it does not create a transfer mechanism itself, but establishes that a transfer to a third country or international organisation is lawful only when it also satisfies one of the specific mechanisms set out in the rest of the chapter, and only if doing so does not undermine the level of protection the GDPR otherwise guarantees — including for onward transfers by the recipient to a further third country. For research administrators, Article 44 is the reason that a lawful basis for processing under Article 6 (and, for special category data, Article 9) is not sufficient by itself once a non-EEA party is involved: a second, independent compliance question — which Chapter V mechanism applies — has to be answered separately.

The mechanisms Article 44 points to

• Article 45 — adequacy decisions. The European Commission has determined that certain countries provide an essentially equivalent level of data protection to the GDPR. Transfers to an adequate country require no further safeguard; the country list is maintained and periodically reviewed by the Commission and changes over time (the EU-US relationship illustrates this: the earlier Privacy Shield adequacy finding was invalidated by the Court of Justice of the EU in Schrems II (Case C-311/18, 16 July 2020), and a successor adequacy decision, the EU-US Data Privacy Framework, was adopted by the Commission on 10 July 2023 — researchers relying on it should confirm current status rather than assume permanence).
• Article 46 — appropriate safeguards. Where no adequacy decision covers the destination country, the most common mechanism for research transfers is the European Commission’s Standard Contractual Clauses (SCCs), a set of pre-approved contract terms the sending and receiving institutions incorporate into their data transfer agreement. Article 47’s Binding Corporate Rules serve the same safeguard role for transfers within a single multinational organisation. Following Schrems II, a party relying on SCCs is expected to carry out a transfer impact assessment confirming that the destination country’s laws (for example, government surveillance access) do not undermine the SCCs in practice, and to layer on supplementary technical or organisational measures if they do.
• Article 49 — derogations for specific situations. Where neither an adequacy decision nor Article 46 safeguards are in place, Article 49(1) lists narrow derogations that can justify a transfer, including the data subject’s explicit informed consent to the specific transfer, transfers necessary for important reasons of public interest, and — for transfers that are not repetitive, involve only a limited number of data subjects, and serve compelling legitimate interests not overridden by the data subject’s rights — a residual derogation available only when documented and accompanied by suitable safeguards. Derogations are intended as exceptions for occasional transfers, not as a routine substitute for SCCs or an adequacy basis on an ongoing research collaboration.

Why this matters for research data management

International research collaborations routinely trigger Chapter V without the underlying activity being labelled a ‘data transfer’ in project planning: shipping a working dataset to a non-EEA co-investigator, hosting a project database on a non-EEA cloud region, granting a non-EEA collaborator remote query access to an EEA-hosted repository, or a multi-site clinical trial with a non-EEA coordinating centre are all transfers for Article 44 purposes. Pseudonymised data does not exempt a transfer from Chapter V either — pseudonymised data remains personal data under GDPR Article 4(5) as long as re-identification is possible, so the same Article 45/46/49 analysis applies. Good practice is to identify the applicable mechanism, and record it in the project’s data management plan and any Data Transfer Agreement, before data first crosses the EEA boundary, rather than after the fact.

References

• Regulation (EU) 2016/679 (GDPR), Articles 44-49 (full Chapter V text at gdpr-info.eu)
• Court of Justice of the European Union, Data Protection Commissioner v Facebook Ireland and Maximillian Schrems, Case C-311/18 (“Schrems II”), judgment of 16 July 2020
• European Commission Implementing Decision (EU) 2023/1795 of 10 July 2023 on the adequate protection of personal data under the EU-US Data Privacy Framework
• European Data Protection Board, Guidelines 05/2021 on the interplay between Article 3 and Chapter V GDPR, and Guidelines 2/2018 on derogations under Article 49