The General Data Protection Regulation (GDPR) permits the transfer of personal data to countries outside of the European Union, commonly referred to as "third countries," in order to facilitate international trade and cooperation.

It is possible to transfer data to certain countries that guarantee an appropriate level of protection for personal data. These countries include Andorra, Argentina, Canada (only for commercial organizations), the Faroe Islands, Guernsey, Israel, the Isle of Man, Jersey, New Zealand, Switzerland, Uruguay, Japan, the United Kingdom, South Korea, and the United States (provided that the recipient adheres to the Data Privacy Framework). In these countries, national legal regulations ensure a level of protection for personal data that is comparable to that provided by EU law.

When transferring data to a third country without an adequate level of protection, it is essential to ensure that the personal data will be safeguarded by the recipient. This assurance can be achieved through methods such as standard contractual clauses, binding corporate rules within a group of companies, or adherence to codes of conduct endorsed by the European Commission. Despite certain exceptions, obtaining the data subject's consent is often necessary for data transfers to countries where adequate protection cannot be guaranteed.