Which of the following types of transfers of personal data outside the European Economic Area (EEA) is allowed?

Which of the following types of transfers of personal data outside the European Economic Area (EEA) is allowed?
A . Transfer between country governments.
B . Transfers subject to the law of the countries involved.
C . Transfers conducted through Standard Contractual Clauses.
D . Transfers conducted under Compulsory Corporate Rules.

View Answer

Answer: D

Explanation:

Compulsory Corporate Rules are rules used internally by multinational companies to transfer personal data. Thus, it is possible to transfer data between them, even if the destination company is in a country that does not have an adequate level of data protection. These rules are like an internal corporate code of conduct and do not cover transfers of personal data outside the corporate group.

Do not confuse "Compulsory Corporate Rules" with "Standard Contractual Clauses". The last are clauses in contracts for international data transfer between companies (customer and supplier relationship) where the destination country does not have an adequate level of data protection, and depends on authorization from the Supervisory Authority.

Article 58 of GDPR