Guidelines 05/2021 on the Interplay between the application of Article 3 and the provisions on international transfers as per Chapter V of the GDPR

What it covers

These guidelines clarify when a processing operation constitutes a 'transfer of personal data to a third country or international organisation' under Chapter V of the GDPR, setting out three cumulative criteria to identify a transfer and explaining the consequences that follow. It also addresses situations where personal data are processed outside the EEA but no transfer takes place, and the safeguards still required in those cases.

Why it matters

It resolves a key definitional gap in the GDPR that determines whether Chapter V transfer safeguards apply, which is central to structuring cross-border data flows and outsourcing arrangements.

Refer to it when

• assessing whether a data flow to a non-EU recipient qualifies as a transfer
• determining whether Chapter V safeguards must be applied
• analysing remote access to EU data from abroad
• distinguishing transfers from processing outside the EEA by the same controller

Questions this document addresses

• What are the three cumulative criteria that qualify a processing operation as a transfer?
• What happens if a transfer takes place without an Article 45 or 46 safeguard?
• What obligations apply when data are processed outside the EEA but no transfer occurs?
• How does Article 3(2) interact with Chapter V for importers already subject to the GDPR?

Topics

• Territorial scope
• International transfers
• Controller & processor
• Security of processing