Any transfer of personal data which are undergoing processing or are intended for processing after transfer to a third country or to an international organisation shall take place only if, subject to the other provisions of this Regulation, the conditions laid down in this Chapter are complied with by the controller and processor, including for onward transfers of personal data from the third country or an international organisation to another third country or to another international organisation. All provisions in this Chapter shall be applied in order to ensure that the level of protection of natural persons guaranteed by this Regulation is not undermined.
Article 44 GDPR - General principle for transfers
Frequently Asked Questions
Short answers to common questions about this provision. They are general information and not legal advice.
Article 44 permits a transfer of personal data undergoing processing, or intended for processing after transfer, to a third country or an international organisation only if the conditions laid down in Chapter V are complied with by the controller and processor, subject to the other provisions of the Regulation. Its closing sentence requires all provisions of the Chapter to be applied so that the level of protection guaranteed by the Regulation is not undermined.
Yes. Article 44 expressly extends the Chapter V conditions to onward transfers of personal data from the third country or international organisation to another third country or another international organisation. The initial exporter cannot therefore treat protection as exhausted once the data leave the Union; the level of protection must follow the data through subsequent transfers.
The Article addresses both the controller and the processor. A processor transferring personal data to a third country must itself satisfy a Chapter V ground, independently of the controller's instructions under Article 28(3), and both actors remain bound by the other provisions of the Regulation when transferring.
No. The transfer may take place only "subject to the other provisions of this Regulation", so a valid Chapter V mechanism does not dispense with a lawful basis under Article 6, the principles of Article 5 or the other obligations of the controller or processor. A transfer is itself a processing operation within Article 4(2) and must satisfy the Regulation as a whole.
The requirement that the level of protection of natural persons guaranteed by the Regulation must not be undermined operates as an interpretive yardstick for the whole Chapter, from adequacy decisions under Article 45 to the derogations of Article 49. Recital 101 confirms that the protection travelling with the data should not be undermined by transfers, which supports reading the specific mechanisms of Articles 45 to 49 in the light of this continuity of protection.