International Data Transfers

Adequacy Decision An adequacy decision is a European Commission finding that a country outside the EU protects personal data to an EU-level standard, so personal data can flow there without standard contractual clauses or other extra safeguards. Binding Corporate Rules (BCRs) Binding corporate rules (BCRs) are a company group's internal data protection rules, approved by a data protection authority, that let the group move personal data from the EU to its own companies in other countries. Data Localization Data localization is a legal requirement that certain data be stored, and sometimes processed, inside a specific country. Data Residency Data residency is where your data is physically stored, such as in EU or US data centers. It is often a choice offered by vendors, not a legal requirement, and it may cover only some of your data. EU-US Data Privacy Framework (DPF) The EU-US Data Privacy Framework (DPF) lets EU companies send personal data to US companies that certify they follow its privacy principles. As of October 2026 it is valid, with an appeal pending at the EU Court of Justice. Privacy Shield Privacy Shield was a program for sending personal data from the EU to certified US companies. The EU Court of Justice struck it down in July 2020, and the Data Privacy Framework replaced it in 2023. Schrems II Schrems II is the 16 July 2020 ruling of the EU Court of Justice that struck down Privacy Shield and kept standard contractual clauses valid, but only if companies check that the destination country's laws let the importer keep its promises. Standard Contractual Clauses (SCCs) Standard contractual clauses (SCCs) are a ready-made contract approved by the European Commission. Companies sign them to legally send personal data from the EU to countries without EU-level protection, such as the US. Swiss-US Data Privacy Framework The Swiss-US Data Privacy Framework lets Swiss companies send personal data to certified US companies without extra contracts. It took effect on September 15, 2024. Transfer Impact Assessment (TIA) A transfer impact assessment (TIA) is a documented check, made before personal data leaves the EU under SCCs or BCRs, of whether the destination country's laws and practices let the recipient keep its data protection promises. UK International Data Transfer Addendum The UK International Data Transfer Addendum adapts the EU standard contractual clauses so they also cover transfers of personal data out of the UK.