Does the GDPR allow data to be moved to outside the EU?
<p>Does the GDPR allow the transfer of data to outside the EU? For example, from Germany to the US?</p>

<p>Yes, GDPR does allow transfers of data to outside the EU, but under conditions. The GDPR does not require that data remain in the EU/EEA. However, it does require that transfers into non-EEA countries (international transfers) comply with the rules in GDPR Chapter 5, starting with Art 44.</p>
<p>There are a couple of legal bases for transfers:</p>
<ul>
<li>Art 45: the target country has an adequate level of data protection, as recognized by an EU adequacy decision. Examples of such countries are Japan, Canada (partial), Switzerland, Israel, and Uruguay. The procedure for adding the United Kingdom is under way (as of Jan 2020).</li>
<li>Art 46–47: the sender and recipient of the personal data implement appropriate safeguards, e.g. implemented through enforceable contract mechanisms like Standard Contractual Clauses (SCCs) or Binding Corporate Rules (BCRs).</li>
<li>Art 49: for occasional transfers, there are some fallbacks such as explicit consent of the data subject</li>
</ul>
<p>The EU and US did have the Privacy Shield treaty. US companies could self-certify under the Privacy Shield mechanism, and were then covered by an adequacy decision. However, this mechanism was deemed invalid in the Schrems II ruling. Furthermore, US companies might not be legally able to comply with the SCCs and BCRs they have signed, due to US mass surveillance laws. This leads to the following situation:</p>
<ul>
<li>Following the Schrems II ruling and subsequent guidance by regulators (e.g. <a href="https://edpb.europa.eu/our-work-tools/public-consultations-art-704/2020/recommendations-012020-measures-supplement-transfer_en" rel="nofollow noreferrer">EDPB Recommendations 01/2020</a>), personal data cannot be transferred into the US unless substantial additional safeguards are implemented, such as only transferring the data in pseudonymized or end-to-end-encrypted form. SCCs alone are not sufficient.</li>
<li>In practice, nearly everyone in the industry is following the legal fiction that updated SCC terms are sufficient to authorize the international transfers. This is technically correct since SCCs were not invalidated through the Schrems II ruling, but not a tenable position given the aforementioned guidance.</li>
</ul>

gdpr