What is Third-country transfer?
A third-country transfer is any transmission of personal data to a recipient outside the European Economic Area. It needs two things at once: an ordinary legal basis for the processing itself, and on top of that a basis for the transfer under Chapter V of the GDPR. The most convenient case is an adequacy decision from the European Commission under Art. 45, which means the destination is treated like an EU country for that purpose. Without one you need standard contractual clauses under Art. 46 and, as a rule, your own assessment of the legal position on the ground.
For the United States an adequacy decision has applied again since 10 July 2023, the EU-US Data Privacy Framework. It covers only recipients actually certified under it, and certification is searchable per company in the public list. The history of these decisions is restless: Safe Harbour fell in 2015, the Privacy Shield in 2020, both through judgments of the Court of Justice. The current decision survived an annulment action before the General Court in 2025, with an appeal pending.
What follows for practice is not an avoidance strategy but an ability to move. Anyone who knows which service holds which data, and how long a switch would take, can plan a change in the law as a project rather than experience it as an emergency. That question can be answered for your three most important tools in an afternoon, and the answer stays useful even if nothing legal changes at all.
Why does Third-country transfer matter?
The risk is rarely the fine, it is the unplanned migration. Twice in ten years the basis for US transfers has fallen away, each time overnight and without a transition period. Businesses that knew their tool list swapped within weeks. The others first had to work out what was even affected. The difference lay not in legal advice but in the stocktake.
Third-country transfer in practice
- 01An analytics tool is replaced by an EU-hosted alternative, not out of caution but because the comparison revealed that nobody reads the reports.
- 02A business checks whether a vendor appears in the Data Privacy Framework list before buying, and makes certification a condition in the tender.
- 03After switching providers the old account remains in place with all its data, because nobody triggered deletion. The transfer does not end with the cancellation.
