Transfers of personal data to third countries are regulated under Articles 27 and 28 of the and also by virtue of Subsidiary Legislation 440.03 'Third County (Data Protection Act) Regulations, 2003’.
A transfer of personal data to another country constitutes processing and as such the processing operation must be notified to the Commissioner accordingly. No restrictions or other formalities apply in relation to transfer of personal data to:
- EU Member States;
- Member countries of the EEA;
- Third countries which are, from time to time, recognised by the EU Commission to have an adequate level of protection;
The transfer of personal data to a third country that does not ensure an adequate level of protection requires an authorisation by the Commissioner.