Article 44

Any transfer of personal data which are undergoing processing or are intended for processing after transfer to a third country or to an international organisation shall take place only if, subject to the other provisions of this Regulation, the conditions laid down in this Chapter are complied with by the controller and processor, including for onward transfers of personal data from the third country or an international organisation to another third country or to another international organisation. All provisions in this Chapter shall be applied in order to ensure that the standard of the protection provided for data subjects with regard to general processing of personal data in the third country or by the international organisation is not materially lower than the standard of the protection provided for data subjects by this Regulation.

In order to ensure a coherent and proportionate application of this Regulation, the assessment of safeguards for transfers of personal data to third countries should take into account the risk-based approach applicable under Articles 24 and 32, including the nature, scope, context and purposes of the processing, as well as the technical and organisational measures implemented by controllers and processors. Such assessment should not affect the requirement that data subjects whose personal data are transferred to third countries continue to benefit from a level of protection of fundamental rights and freedoms essentially equivalent to that guaranteed within the Union, in accordance with the Charter of Fundamental Rights of the European Union and the case law of the Court of Justice of the European Union.

To support efficient data transfers within multinational corporate groups, supervisory authorities should take into account whether companies apply common internal data protection, security and compliance standards across the group. Where a group has binding internal rules, effective safeguards, and mechanisms to protect data subjects’ rights and remedies, this may create a rebuttable presumption that appropriate safeguards under Article 46 are met. Such presumption should not reduce the level of protection guaranteed under this Regulation, the Charter of Fundamental Rights of the European Union, or the case law of the Court of Justice of the European Union, including regarding access to data by public authorities in third countries.