In each scenario, the parties should understand and record the underlying personal data that is transferred in order to know their own responsibilities and the responsibilities of the third party concerned that are expressed in the transfer agreement. You can make a limited transfer if you and the recipient have entered into a custom contract for a specific limited transfer, which has been approved individually by the country`s control authority for exporting personal data. If you make a limited transfer from the UK, the ICO must have approved the contract. There must be a European or British law that says or implies that this type of transfer is authorized for important public interest reasons, which may be in a spirit of reciprocity for international cooperation. For example, an international agreement or agreement (signed by the UK or THE EU) that recognises certain objectives and provides for international cooperation (such as the 2005 International Convention on combating acts of nuclear terrorism). The UK government is asking for a decision on the adequacy of the European Commission. At the end of the transitional period, EEA transfers to the United Kingdom must comply with the RGPD transfer restrictions if no adequacy decision is taken. The transfer does not mean the same thing as transit. When personal data is transmitted only electronically by a non-EEA country, but the transfer is actually made from one EEA country to another EEA country, it is not a limited transfer. You can make a limited transfer if you and the recipient are logged into a group document called binding corporate rules (BCRs).

Most US companies that receive European personal data are aware that the RGPD prohibits the transfer of personal data from the EEA to “third countries” that do not benefit from an “adequacy decision” from the Commission (currently only 12 countries have one), unless the restricted transfer is not covered by appropriate guarantees? The EFTA states are Iceland, Norway and Liechtenstein.