The transfer of personal data to countries outside the European Economic Area (EEA) remains one of the most fraught topics in privacy and data protection law. At a time when international data flows are the backbone of digital services, they simultaneously pose significant legal, ethical and geopolitical challenges. Questions of privacy protection, oversight, data sovereignty, and the impact of foreign law on European citizens are the focus of this thematic file "Data Transfer Abroad."

We highlight the legal frameworks, policy developments, and technological implications of cross-border data exchange, focusing on the changing realities of digital markets, data centers, and cloud infrastructures.

Topics in this file

• When is a transfer of personal data and what are the requirements of the AVG and the EDPB , including recent interpretations by national regulators.
• The impact of the Schrems II judgment on current practice and the continuing tension between European privacy laws and foreign surveillance laws.
• The use of Standard Contractual Clauses (SCCs), BindingCorporate Rules (BCRs) and additional technical and organizational measures as safeguards for data transfer.
• The legal and political context of the EU-U.S. Data Privacy Framework, including the ongoing discussion of its sustainability and effectiveness in light of new litigation and surveillance practices.
• The Role of Data Transfer Impact Assessments (DTIAs) and risk assessments in assessing transfer practices, focusing on guidance from the EDPB and national authorities.
• Case studies on how governments, healthcare organizations and businesses are dealing with cloud use, interoperability, international partnerships and compliance issues.
• The growing debate about European data sovereignty, the development of alternatives such as GAIA-X and the call for transparency in the international data structure.
• New developments in AI and data exchange, such as model data transfer and dataset access outside the EEA.

This dossier explores how organizations can position themselves in this global context: legally sound, technologically secure and in line with European values around privacy and autonomy.