International data transfers

Many AI tools are hosted or managed outside Europe. When personal data is sent to them there is an international transfer, and Chapter V of the GDPR requires a safeguard so the data remains protected.

The main routes are: a Commission adequacy decision (the country offers equivalent protection; for the US, companies certified under the 2023 EU-US Data Privacy Framework); the Commission's standard contractual clauses, together with an assessment of the destination country's risks; or binding corporate rules within multinational groups.

Before approving an AI tool, check where data is processed, which safeguard the vendor relies on and whether a data processing agreement covers it.