What counts as a third-country transfer
A third country is any country outside the European Economic Area (the EU plus Iceland, Liechtenstein and Norway). A transfer happens when personal data is sent to a recipient there – or made accessible to one, for example through remote access by a support team or an administrator abroad.
The rules are in Chapter V of the GDPR (Articles 44 to 50). They apply in addition to the general rules: a transfer also needs a legal basis for the processing itself.
The three routes
- Adequacy decision (Art. 45)
- The European Commission has found that the country ensures an adequate level of protection – for example Switzerland, the United Kingdom or Japan, and for certified organisations the USA under the Data Privacy Framework.
- Appropriate safeguards (Art. 46, 47)
- Above all standard contractual clauses and binding corporate rules. Since Schrems II they require a case-by-case assessment of the recipient country’s law.
- Derogations (Art. 49)
- Exceptions for specific situations, such as explicit consent or a transfer necessary for a contract with the person. They are meant for occasional, not regular transfers.
In practice
- Map which providers and subprocessors receive or can access personal data outside the EEA.
- Note the transfer mechanism for each – adequacy decision, SCC or exception.
- For SCC: document a transfer impact assessment and supplementary measures, such as encryption with keys held in the EU.
- Inform the people concerned in your privacy notice.
Coviqo stores and processes content on servers in Germany. Where data does leave the EU – network protection and CDN, payments, optional sign-in providers and integrations – transfers are based on the Data Privacy Framework where the recipient is certified, otherwise on standard contractual clauses. Details: Why a European collaboration platform.
This page is general information, not legal advice.
Frequently asked questions
Is a US provider with an EU data centre a third-country transfer?
Not automatically – data stored in the EU is not transferred by storage alone. But remote access from the USA can be a transfer, and the provider may be subject to US law such as the CLOUD Act.
Is the United Kingdom a third country?
Yes, since Brexit. The European Commission has recognised the UK as providing adequate protection since 2021; as long as that adequacy decision applies, transfers there need no additional safeguards.