What are the rules for international data transfers under GDPR?

What are the rules for international data transfers under GDPR?

Under GDPR, personal data can only be transferred outside the EU if the destination country ensures an adequate level of data protection.

How can I determine if a country has adequate protection?

You can check if the European Commission has issued an adequacy decision for that country, which confirms its data protection standards.

What if the country doesn't have an adequacy decision?

In that case, you can use standard contractual clauses or binding corporate rules to ensure adequate protection for the data.

Are there any exceptions to these rules?

Yes, exceptions include situations where the individual has given explicit consent or when the transfer is necessary for contract performance.