How do I transfer data out of the EEA?

If you are to transfer personal data out of the European Economic Area, special requirements apply. Some countries are approved by the European Commission as sufficiently secure for transmission (so called adequacy decisions). This means that you can transfer data as if the country was part of the EEA. See an overview of "whitelisted" countries here. 

Another basis for transfer can be established through sufficient guarantees secured by standard contractual clauses (SCC's) adopted by the European Commission or binding corporate rules (BCR) for a group of entities. It is also possible to develop your own contractual terms for transfer, but these must be pre-approved by the Norwegian Data Protection Authority and/or the European Data Protection Board . 

In addition to a legal basis for the transfer, you need to make sure that it is possible to uphold the high level of protection that is guaranteed in the EEA in the receiving third country. The European Data Protection Board has published recommendation for transfers, which you can find here.

Wondering which basis for transfer you may use? Contact us here.