In one sentence. GDPR Article 44 establishes the general principle that any transfer of personal data to a third country or international organisation may only take place if conditions in Chapter V (Articles 44-50) are complied with — including by subsequent transfers to other third countries. The provision exists to ensure that the level of protection guaranteed by the GDPR is not undermined. Article 44 is the umbrella that anchors the entire international transfer framework: adequacy decisions (Article 45), safeguards (Article 46), BCRs (Article 47), and derogations (Article 49).
Article 44 is procedurally short but conceptually foundational. It sets the rule: data leaving the EU/EEA must continue to enjoy GDPR-equivalent protection. The mechanisms to ensure that protection are detailed in the subsequent articles. The Schrems II judgment (CJEU C-311/18, 2020) made clear that the obligation extends beyond formal compliance — the controller must verify that protection is effectively delivered.
For specific transfer mechanisms: Standard Contractual Clauses (SCCs), Transfer Impact Assessment (TIA), BCR vs SCC vs DPF. For the broader cross-border framework: GDPR cross-border data transfers.
Key takeaways
- Article 44 = umbrella for the entire Chapter V (Articles 44-50).
- The protection level guaranteed by the GDPR must not be undermined by international transfers.
- Applies to direct transfers AND onward transfers (from one third country to another).
- Routes include adequacy, appropriate safeguards (including BCRs), and narrowly framed derogations.
- Schrems II added: formal mechanism alone is not enough — effective protection in the destination country must be verified (TIA).
1. Article 44 text
“Any transfer of personal data which are undergoing processing or are intended for processing after transfer to a third country or to an international organisation shall take place only if, subject to the other provisions of this Regulation, the conditions laid down in this Chapter are complied with by the controller and processor, including for onward transfers of personal data from the third country or an international organisation to another third country or to another international organisation. All provisions in this Chapter shall be applied in order to ensure that the level of protection of natural persons guaranteed by this Regulation is not undermined.”
Two key principles:
- All Chapter V conditions apply — adequacy, safeguards, BCRs, derogations
- Including for onward transfers — the chain doesn’t break at the first destination
2. Select the applicable transfer route
| Route | Article | Scope to establish |
|---|---|---|
| Adequacy decision | 45 | Recipient and transfer covered by the Commission decision |
| Appropriate safeguards | 46 | Enforceable rights, effective remedies and the particular safeguard’s conditions |
| Binding Corporate Rules | 46(2)(b) and 47 | Approved rules covering the bound members and processing |
| Derogations | 49 | The specific exceptional conditions for the proposed transfer |
BCRs are an Article 46 safeguard, not a lower-ranked alternative after all other safeguards. The EDPB BCR recommendations make this relationship explicit. Article 49 requires a separate, restrictive assessment; it is not a routine workaround for missing safeguards.
3. Adequacy decisions (Article 45)
Check the Commission’s current adequacy decisions, including their territorial, recipient and data scope. A static country list can become incomplete: the current Commission page includes Brazil, which earlier lists omitted. Retain the decision and the date of your scope check.
An applicable adequacy decision provides the Article 45 transfer route; it does not turn a third country into the EEA or remove other GDPR obligations. For the US framework, verify the exact legal entity’s active certification and covered data. The Canadian decision has a defined scope rather than covering every Canadian recipient; see the Canada transfer assessment.
For a destination without an applicable adequacy decision, examine the available safeguards or specific derogation. SCCs are one possible safeguard, not a universal requirement for every flow. The India transfer guide provides related operational context.
4. Appropriate safeguards (Article 46)
When no adequacy decision applies, the controller must implement appropriate safeguards. Options:
- Standard Contractual Clauses (SCCs) approved by the Commission — most common
- Binding Corporate Rules (BCRs) for intra-group transfers
- Approved codes of conduct (Article 40)
- Approved certification mechanisms (Article 42)
- Ad hoc clauses approved by the supervisory authority
- Legally binding instruments between public authorities
Post-Schrems II, all Article 46 safeguards require a Transfer Impact Assessment verifying that the safeguard delivers effective protection in the destination country.
5. Binding Corporate Rules (Article 47)
BCRs are internal corporate policies approved by a supervisory authority that allow intra-group transfers. They require:
- Legally binding nature throughout the group
- Express conferral of enforceable rights on data subjects
- Specific minimum content (Article 47(2))
- Approval by the lead supervisory authority through the consistency mechanism
6. Derogations (Article 49)
Narrow exceptions for specific situations:
- (a) Explicit consent of the data subject
- (b) Necessary for contract performance with the data subject
- © Necessary for contract performance in the data subject’s interest
- (d) Important reasons of public interest
- (e) Establishment, exercise or defence of legal claims
- (f) Protect vital interests when consent impossible
- (g) Transfer from a public register
- Article 49(1), second subparagraph: a separate residual route subject to cumulative conditions, including non-repetitive transfers, limited numbers of people, compelling legitimate interests, suitable safeguards and required information to the authority and individuals
Article 49 derogations must be interpreted restrictively and assessed individually. The provisions have different conditions, including particular necessity, occasional-transfer or non-repetitive requirements. Do not treat a broad label such as consent or public interest as sufficient evidence of compliance.
7. The Schrems II requirement
The CJEU in Schrems II (C-311/18, July 2020) added a key requirement: the controller must verify that the destination country’s law and practice provide essentially equivalent protection. Where needed, assess supplementary measures against the identified problem. Encryption is not sufficient if the recipient must access plaintext and the relevant risk remains. If effective protection cannot be ensured under the Article 46 tool, do not start or continue that transfer; suspend it or redesign the arrangement before proceeding on a valid basis.
This requirement applies to all Article 46 safeguards (SCCs, BCRs, codes of conduct, certifications). It does NOT apply to Article 45 adequacy decisions (since the Commission has already made the assessment).
See Transfer Impact Assessment (TIA) for the methodology.
8. Onward transfers
Article 44 explicitly extends the obligation to onward transfers — data leaving the first destination for another third country. This means:
- The contractual mechanism with the first recipient must address onward transfers
- The SCCs include clauses obligating the importer to ensure equivalent protection for any onward transfer
- The controller remains responsible for chain integrity
In practice, this means auditing the entire data flow, not just the first hop.
9. Sanctions
Article 83(5)© places Article 44 violations at the top tier — up to EUR 20 million or, for an undertaking, 4% of total worldwide annual turnover in the preceding financial year, whichever is higher.
When reading an enforcement decision, record the exact transfer, legal tool, findings and corrective measures. Do not label a security or lawful-basis case as an Article 44 sanction without checking the decision. A fine’s legal basis and procedural status matter more than an unsupported ranking of the most expensive GDPR provisions.
10. Practical compliance workflow
For each cross-border transfer:
- Identify the destination country
- Check adequacy (Article 45) — if adequate, no further mechanism needed
- For US transfers: verify DPF certification of the recipient
- For non-adequate destinations: select Article 46 safeguard (typically SCCs)
- Conduct TIA for Article 46 safeguards (post-Schrems II)
- Document supplementary measures if needed (technical, contractual, organizational)
- Sign SCCs or other instrument
- Record in ROPA the destination country and safeguard mechanism
- Annual review of adequacy, certifications, transfer mechanism validity
11. Tooling
For related deep-dives: Standard Contractual Clauses, TIA guide, BCR vs SCC vs DPF, GDPR cross-border data transfers.
Official sources
- Regulation (EU) 2016/679 (GDPR) — Chapter V on EUR-Lex
- EDPB guidelines, recommendations and best practices
- ICO — international transfers guidance
Conclusion
Article 44 is the GDPR’s commitment that protection doesn’t stop at the EU border. Every other transfer article (45-50) is a mechanism to deliver on that commitment. A transfer decision must be supported by the applicable legal conditions and operational evidence, not only a signed document.
FAQ
What does GDPR Article 44 require?
Article 44 establishes the general principle: any transfer of personal data to a third country must comply with Chapter V (Articles 44-50), including for onward transfers. The level of protection guaranteed by the GDPR must not be undermined.
How should I choose a transfer route?
Check whether an adequacy decision covers the actual recipient and processing. Otherwise assess an appropriate safeguard, including SCCs or approved BCRs where applicable, or the conditions of a specific Article 49 derogation. BCRs belong within Article 46; they are not a separate inferior rank.
Which countries have an adequacy decision?
Use the Commission’s current official list and read the relevant decision’s scope. Country names alone are insufficient where coverage is limited by recipient, sector or framework certification.
Does Article 44 apply to onward transfers?
Yes — explicitly. Data leaving the first destination for another third country must continue to comply with Chapter V. Contractual mechanisms must address the entire chain.