The Guidelines provide three criteria for qualifying a data processing operation as a data transfer: the involvement of a GDPR-subjected data exporter, the transmission or sharing of personal data with an importer, and the location of the importer in a third country or international organization, regardless of their GDPR Article 3 status. The objective is to determine when data transfers require Chapter V compliance, distinct from the broader applicability of Article 3. The guidelines also include practical examples and an annex to demonstrate various data transfer scenarios.
Author: European Data Protection Board
Status: Adopted / Published
Adoption date: 2023-02-24
Last updated: 08 Aug 2025
Category: Guidance
Subcategory: Official guidance