Law note · European Union
GDPR Chapter V, Cross-Border Transfer Restrictions
Chapter V bars any transfer of personal data outside the EEA unless the European Commission has issued an adequacy decision (Article 45), the transfer is covered by an appropriate safeguard such as Standard Contractual Clauses or Binding Corporate Rules together with a transfer impact assessment under the Court of Justice's Schrems II judgment (Case C-311/18, 16 July 2020), or a narrow Article 49 derogation applies.
Most transfers to the United States currently rely on the EU-US Data Privacy Framework, found adequate by Commission Implementing Decision (EU) 2023/1795. The General Court upheld that adequacy decision at first instance in Latombe v Commission (Case T-553/23, 3 September 2025), and an appeal is pending before the Court of Justice as Case C-703/25 P, with no hearing date set as of this research.
What it asks of an app
- Rely on a Commission adequacy decision, Standard Contractual Clauses with a transfer impact assessment, Binding Corporate Rules, or a narrow Article 49 derogation before moving personal data of a person in the EU outside the EEA.
When LexLint raises it
Declared activities: crawls_web, trains_models, deploys_chatbot, automated_outreach, processes_voice, processes_biometrics
Primary source: Official Journal text, EUR-Lex, Regulation (EU) 2016/679
Commission Implementing Decision (EU) 2023/1795