Tools for transfers and derogations

In the absence of an adequacy decision, transfers of personal data outside the EU can only take place if they are subject to appropriate safeguards. Organisations can use different tools in order to safely transfer personal data outside of the EU (such as Binding Corporate Rules or Standard Contractual Clauses).
Certain derogations permit the transfer of personal data outside the EU when there is no adequacy decision or appropriate safeguards in place: these exceptional measures can only be relied on if specific conditions apply, and not as a regular transfer tool, as they do not provide any safeguards to the data transferred outside the EU.
The EDPB adopts opinions and issues guidance on different types of transfers tools and on derogations, to ensure their consistent application within the EU.