← GDPR · Transfers
Art.44-49 — Transfers of personal data to third countries
Requirement
Transfers of personal data outside the EEA require an adequacy decision, appropriate safeguards such as standard contractual clauses or binding corporate rules, or a derogation, together with a transfer impact assessment where safeguards are relied upon.
UK GDPR: UK GDPR has its own transfer regime: the ICO's International Data Transfer Agreement (IDTA) or the UK Addendum to the EU SCCs, and UK adequacy regulations (including the UK–US data bridge).
What the engine looks for
Every group below must be satisfied — by an affirmative statement, not a plan, a hedge or a denial — for the control to count as covered. A term ending in … matches any word it begins. Supporting terms do not change the verdict — they raise confidence and distinguish a policy that names a mechanism from one that gestures at a category.
Finding any of these outranks coverage — a policy that admits the gap is worse than silence.
Equivalent controls elsewhere
Matched on shared topics. Satisfying this control usually moves these too.
| Framework | Control | Title | Shared topics |
|---|---|---|---|
| NDPA 2023 | s.41-43 | Cross-border transfer of personal data | cross-border-transfer vendor-management |
| CCPA/CPRA | 1798.100(d) | Contracts with service providers, contractors and third parties | vendor-management |
| SOC 2 | CC2.3 | External communication | vendor-management |
| SOC 2 | CC9.2 | Vendor and business partner risk management | vendor-management |
| ISO 27001 | A.5.19 | Information security in supplier relationships | vendor-management |
| ISO 27001 | A.5.23 | Information security for use of cloud services | vendor-management |
| PCI DSS 4.0.1 | 12.8 | Third-party service provider management | vendor-management |
| HIPAA | 164.308(b)(1) | Business associate contracts (R) | vendor-management |