The transfer of personal data to a country outside the EU or EEA, which the GDPR permits only under specific safeguards.
The GDPR restricts sending personal data outside the EU or EEA unless the destination ensures an adequate level of protection. Transfers can rely on an adequacy decision, on safeguards such as Standard Contractual Clauses, or on specific derogations.
Organizations often also need a transfer impact assessment to confirm that the data will be protected in practice in the destination country.
Related frameworks
KaitoSec