data”). To that extent, this Regulation does not exclude Member State law that sets out the
circumstances for specific processing situations, including determining more precisely the
conditions under which the processing of personal data is lawful.
…
(101)
Flows of personal data to and from countries outside the Union and international
organisations are necessary for the expansion of international trade and international cooperation.
The increase in these flows has raised new challenges and concerns with regard to the protection
of personal data. However, when personal data are transferred from the Union to controllers,
processors or other recipients in third countries or to international organisations, the level of
protection of natural persons ensured in the Union by this Regulation should not be undermined,
including in cases of onward transfers of personal data from the third country or international
organisation to controllers, processors in the same or another third country or international
organisation. In any event, transfers to third countries and international organisations may only
be carried out in full compliance with this Regulation. A transfer could take place only if, subject
to the other provisions of this Regulation, the conditions laid down in the provisions of this
Regulation relating to the transfer of personal data to third countries or international
organisations are complied with by the controller or processor.
…
(103)
The Commission may decide with effect for the entire Union that a third country, a territory or
specified sector within a third country, or an international organisation, offers an adequate level
of data protection, thus providing legal certainty and uniformity throughout the Union as regards
the third country or international organisation which is considered to provide such level of
protection. In such cases, transfers of personal data to that third country or international
organisation may take place without the need to obtain any further authorisation. The
Commission may also decide, having given notice and a full statement setting out the reasons to
the third country or international organisation, to revoke such a decision.
(104)
In line with the fundamental values on which the Union is founded, in particular the
protection of human rights, the Commission should, in its assessment of the third country, or of a
territory or specified sector within a third country, take into account how a particular third
country respects the rule of law, access to justice as well as international human rights norms and
standards and its general and sectoral law, including legislation concerning public security,
defence and national security as well as public order and criminal law. The adoption of an
adequacy decision with regard to a territory or a specified sector in a third country should take
into account clear and objective criteria, such as specific processing activities and the scope of
applicable legal standards and legislation in force in the third country. The third country should
offer guarantees ensuring an adequate level of protection essentially equivalent to that ensured
within the Union, in particular where personal data are processed in one or several specific
sectors. In particular, the third country should ensure effective independent data protection
supervision and should provide for cooperation mechanisms with the Member States’ data
protection authorities, and the data subjects should be provided with effective and enforceable
rights and effective administrative and judicial redress.
…
(107)
The Commission may recognise that a third country, a territory or a specified sector within a
third country, or an international organisation no longer ensures an adequate level of data
protection. Consequently the transfer of personal data to that third country or international
organisation should be prohibited, unless the requirements in this Regulation relating to transfers
subject to appropriate safeguards, including binding corporate rules, and derogations for specific
situations are fulfilled. In that case, provision should be made for consultations between the
Commission and such third countries or international organisations. The Commission should, in a
timely manner, inform the third country or international organisation of the reasons and enter into
consultations with it in order to remedy the situation.