Transfers of personal data to countries outside the European Union

Adequacy decisions

Under Article 25 of the EC Data Protection Directive (Directive 95/46/EC) the European Commission have the power to make findings that third countries (ie countries outside the European Union) ensure an adequate level of protection for personal data transferred from within the Member States of the European Union.

The findings are binding on the Member States of the European Union, including the United Kingdom.

They have the effect that personal data may be freely transferred to the third countries in question in the circumstances provided for in the findings. The European Commission have made "adequacy" findings for:

• Switzerland
• Hungary
• The United States' "safe harbor" arrangements
• Canada's Personal Information Protection and Electronic Documents Act
• Argentina
  

Model contracts

Under Article 26 of the EC Data Protection Directive (Directive 95/46/EC) the European Commission have the power to decide that certain standard contractual clauses provide sufficient safeguards for data protection where the contractual clauses are to be used for the transfer of personal data to third countries (ie countries outside the European Union) which do not provide an adequate level of protection for personal data transferred from within the Member States of the European Union.

The decisions are binding on the Member States of the European Union, including the United Kingdom. They have the effect that the standard contractual clauses may be used to support transfers of personal data to third countries in the circumstances provided for in the decisions.

The European Commission have made decisions about standard contractual clauses for the transfer of personal data to:

• Data controllers in third countries
• Data processors in third countries

• Back to top

© Crown Copyright