Under the General Data Protection Regulation (GDPR), personal data transfer outside of the EEA (i.e. EU and Norway, Lichtenstein and Iceland) or to international organisations are allowed only if one of the following conditions is met:
the third country is recognised as providing an adequate level of protection via an adequacy decision adopted by the European Commission;
adequate safeguards are implemented (e.g. EU Standard Contractual Clauses, BCR, approved certification or code of conduct.);
a derogation provided for in article 49 is applicable (e.g. express consent, vital interest etc.).