Recommended
Recommended
More Related Content
Recently uploaded
Recently uploaded (20)
Featured
Featured (20)
GDPR Decision Flow: Lawful Transfers of Personal Data from EU to US
- 1. Will these transfers be sporadic and limited to a few data subjects? GDPR Art. 49(1) Can we claim a derogation for lawful transfers? GDPR Art. 49(1) Do we provide adequate safeguards to protect personal data? GDPR Art. 46(2) Does the EU recognize the US as having adequate safeguards? GDPR Art. 45(3) Will we seek explicit consent prior to the transfer? GDPR Arts. 49(1)(a), 6(1)(a), 7 and 8 Lawful Transfers of Personal Data from EU to US Decision-Flow Summary Copyright©2019SecureDigitalSolutions,Inc.|AllRightsReserved.
- 2. Lawful Transfers of Personal Data from EU to US Decision-Flow Detail Start Will we seek explicit consent prior to the transfer? Arts. 49(1)(a), 6(1)(a), 7 and 8 Transfer is LawfulWe want to transfer personal data from the EU to another commercial entity in the US. What are our legal options under GDPR? Do we provide adequate safeguards to protect personal data? Art. 46 Binding Corporate Rules (BCRs) Art. 47 Standard Data Protection Clauses Art. 93(2) An approved Code of Conduct? Arts. 40 and 41 An approved Certification Mechanism Art. 42 Custom Contractual Clauses Between Controller and Processor? Art. 46(3)(a) DPAAuthorizationNotRequired DPAAuthorization Required Art. 46(2) Art. 46(3) Does the EU recognize the US as having adequate safeguards? Art. 45(3) Do we participate in the Privacy Shield Framework? Yes No No Yes No Can we claim a derogation for lawful transfers? Art. 49(1) Is the transfer necessary for the performance of a contract? Art. 49(1)(b) Is the transfer necessary for the performance of a contract? Art. 49(1)(b) Is the transfer necessary for the conclusion of performance of a contract? Art. 49(1)(c) Is the transfer necessary for important reasons of public interest? Art. 49(1)(d) Is the transfer necessary for the establishment, exercise or defence of legal claims? Art. 49(1)(e) Is the transfer necessary to protect the vital interests of data subjects? Art. 49(1)(f) Will these transfers be sporadic and limited to a few data subjects? Art. 49(1) Do we plan to transfer special categories of personal data? Art. 9 Do we have a compelling legitimate interest? Art. 49(1) Do we have suitable safeguards in place? Art. 49(1) Have we informed the DPA and data subjects? Art. 49(1) Transfer is Lawful, But Restricted Art. 49(5) Transfer is Not Lawful Yes Yes Yes No No Have we properly informed the data subject of the risks of transferring personal data from the EU to the US? Art. 49(1)(a) Yes Yes Yes Yes Yes No Copyright©2019SecureDigitalSolutions,Inc.|AllRightsReserved.