An EU-based controller wants to use a cloud provider located in a third country that does not have an adequacy decision from the European Commission. Which mechanism can lawfully enable the transfer of personal data to that provider under the GDPR?

The GDPR permits transfers of personal data to third countries on the basis of a Commission adequacy decision or, failing that, appropriate safeguards such as standard contractual clauses or binding corporate rules, with limited derogations for specific situations. Standard contractual clauses are pre-approved contract terms that bind the importer to EU-level protections. Following the Court of Justice ruling known as Schrems II, exporters must assess whether the law and practice of the destination country allow the importer to comply, often documented in a transfer impact assessment, and add supplementary measures such as strong encryption with keys held in the EU where necessary. A data protection officer advises and monitors compliance but cannot issue adequacy decisions; only the European Commission does that, for countries, territories or sectors, not individual vendors. ISO/IEC 27001 certification demonstrates an information security management system, yet it is not a GDPR transfer mechanism. Encrypting data in transit protects confidentiality on the network but the data is still transferred and processed abroad, so the transfer rules still apply. Exam caveat: adequacy decisions can be invalidated or replaced, so transfer bases need periodic review. Operational check: confirm each data flow to a third country has a documented transfer basis, signed clauses and an impact assessment.