Skip to main content

​
GDPR international transfers

If your organization is established in the EU or processes EU personal data, you must answer a separate question from “where is this data stored?”: what legal mechanism permits the data to be made available outside the EEA? This page explains the Chapter V (Articles 44–49) framework and the Orbit evidence you can use when you document that answer.
This page describes Orbit’s platform evidence, not legal advice. You are the controller for your processing decisions. Ask qualified counsel to confirm whether a transfer takes place, which mechanism applies, and whether your supplementary measures are effective.

​
The transfer question every EU tenant must answer

Article 44 sets the rule for the whole of Chapter V: a transfer of personal data to a third country, or an international organization, must preserve the level of protection provided by the GDPR. The transfer analysis is separate from your lawful basis under Article 6 and from your retention or residency settings. A transfer can occur when personal data is sent, made available, or accessed from outside the EEA as part of processing. It is not limited to a permanent copy or to a data center physically moving. For example, include these Orbit scenarios in your assessment:
  • An Orbit support operator in the United States is permitted to view EU tenant records while troubleshooting. The remote access can be a transfer, even if the record remains stored in the EEA.
  • An Orbit subprocessor processes message content, contact data, call metadata, or account information from a US location. Review that subprocessor’s location, role, and mechanism in the subprocessor registry.
  • Your own staff, contractors, analytics tools, or customer support system access an Orbit export from outside the EEA. Orbit’s mechanism does not automatically cover your onward transfer.
Start with the parties, data categories, locations, access paths, and purposes in your Art. 30 register. Record an entry even when your conclusion is that Chapter V does not apply; keep the reasoning with the activity so a reviewer can follow it. The data residency overview answers where Orbit services process particular data classes. It does not, by itself, select a Chapter V transfer mechanism. A region pin is a location control, not a substitute for a transfer assessment. Choose the mechanism that matches the actual recipient, location, and data flow. The options below are not interchangeable checkboxes.

​
Adequacy decisions (Article 45)

The European Commission can decide that a country, territory, sector, or international organization provides an adequate level of protection. A transfer to a covered destination can rely on that decision without a separate transfer instrument, but check its scope and conditions on the date of your assessment. An adequacy decision for one destination does not cover a different country or an onward transfer.

​
Appropriate safeguards (Article 46)

Where no applicable adequacy decision exists, the controller must normally use an Article 46 safeguard and provide enforceable rights and effective remedies. For the Orbit vendor relationship, the most common safeguard to investigate is the European Commission’s Standard Contractual Clauses (SCCs), Article 46(2)(c). Do not record “SCC” solely because a vendor is listed: use the current registry entry and the executed Data Processing Agreement (DPA) to identify the parties, module, destination, and supplementary terms that actually apply. For UK-restricted transfers, check whether the UK International Data Transfer Agreement (IDTA) or UK Addendum is required. A UK mechanism does not replace the EEA analysis. For other jurisdictions, your counsel may select another Article 46 safeguard, such as an approved code of conduct or certification with binding and enforceable commitments. Binding corporate rules (BCRs), Article 46(2)(b), can support transfers within a multinational group after regulatory approval. They are the exporting organization’s or group’s framework, not a setting Orbit turns on for a tenant. Confirm that the approved BCRs cover the recipient and processing at issue.

​
Derogations (Article 49)

Article 49 exceptions are narrow and should not become a routine operating model. Depending on the facts, a derogation can cover a transfer that is:
  • based on the data subject’s explicit, specific, and informed consent;
  • necessary for a contract with the data subject, or for pre-contract steps;
  • necessary for an important public interest recognized in law;
  • necessary to establish, exercise, or defend legal claims;
  • necessary to protect vital interests; or
  • made from a public register under the conditions in Article 49.
Some derogations are occasional rather than repetitive, and consent must explain the relevant risks. Document the exact exception and its limits in your register. Do not use Article 49 as a permanent replacement for SCCs or another Article 46 safeguard when a regular transfer exists.

​
Which mechanism applies to Orbit subprocessors?

Orbit can route different data classes through different subprocessors and locations. Therefore, there is no single tenant-wide answer such as “all Orbit data uses adequacy” or “all Orbit data uses SCCs.” For every relevant registry row, record the published region, data categories, purpose, and the contractual transfer instrument identified by Devotel. If the row is covered by an adequacy decision, record that decision; if it relies on SCCs or supplemental terms, record those instead. Ask Devotel before relying on a contract answer that the published artifacts do not support.

​
Where the transfer mechanism lives in Orbit artifacts

Use these artifacts together. Each answers a different part of the evidence chain:
  1. Subprocessor registry — identifies the third party, purpose, processing region, data categories, and available vendor agreement links. Treat it as a live disclosure, not a tenant setting; review its change history before a procurement submission.
  2. Data Processing Agreement — records the Article 28 processor relationship, subprocessors, and the transfer terms that apply to the services. The DPA and its referenced SCCs / Data Use Framework (DUF) terms are the contractual instruments to review for the applicable transfer. Where UK data is in scope, check the IDTA or UK Addendum identified in the contract set.
  3. Privacy register — gives you the tenant-owned Art. 30 record where you name the activity, recipients, countries, transfer safeguard, and security measures. Orbit does not file that record for you.
For each activity, copy the relevant registry evidence into your own register rather than writing a generic “Orbit is GDPR compliant” statement. Keep the registry version or review date, the DPA version, the selected module or supplement, and any counsel-approved supplementary measures with the record. Recheck the entry when Devotel publishes a subprocessor change or updates the DPA.

​
Schrems II: what to check before you rely on SCCs

The Court of Justice’s Schrems II decision did not invalidate SCCs. It made clear that signing SCCs is not the end of the assessment. Before relying on an SCC-based transfer, evaluate whether the law and practice in the destination could prevent the importer from meeting the clauses and whether the parties’ measures still provide essentially equivalent protection. For each transfer, ask your counsel and security team to check:
  • Destination and legal exposure: Which entity receives the data, from where can it be accessed, and could public-authority access laws apply? A US hosting or support location needs a documented assessment of the relevant exposure, not a country-name assumption.
  • Data minimization: Which fields are necessary for the stated purpose? Remove or tokenize data before it reaches the transfer boundary where your workflow allows it.
  • Encryption: Confirm encryption in transit and at rest, key custody, access controls, logging, retention, and the conditions for provider access. Encryption is a measure to assess, not an automatic conclusion that a transfer is lawful.
  • Tenant-side separation: Use Customer-Managed Keys (BYOK) to keep key-management decisions in your KMS, and the PII Vault to use tenant-scoped tokens instead of raw identifiers where that fits your processing. Validate the exact scope of each control; neither page selects a Chapter V mechanism for you.
  • Access and onward transfers: Review support roles, audit records, subprocessor access, deletion, and onward-transfer restrictions. A safeguard must remain effective throughout the chain.
If the assessment finds that SCCs alone are not sufficient, document the additional measures, pause the affected flow, or select another lawful path with counsel. Do not claim that BYOK, tokenization, or a region pin by itself resolves the Schrems II analysis.

​
Worked example: answer a security questionnaire

Suppose an EU tenant sends support SMS and stores contact identifiers in Orbit. A questionnaire asks: “Do you transfer EU personal data outside the EEA, and what safeguard applies?”
  1. List the data flows and recipients in the tenant’s privacy register: contact identifiers, message content and metadata, Orbit as processor, each relevant subprocessor, destination, purpose, and retention.
  2. Cite the subprocessor registry for each vendor’s name, purpose, data categories, processing region, and change date.
  3. Cite the executed DPA, including its current version and the referenced SCC, DUF, or IDTA/Addendum terms that apply to the destination. Do not cite an instrument that the artifacts do not identify for that flow.
  4. Attach the tenant’s transfer-impact assessment and supplementary-measures decision. Cite Customer-Managed Keys (BYOK) and PII Vault only for controls the tenant actually enabled and scoped to this data.
  5. Link the data residency overview for the platform geography explanation, while stating that geography and the Chapter V safeguard are separate answers.
A concise answer could be: “We maintain a flow-level Art. 30 record. The current Orbit subprocessor registry identifies the vendors, purposes, locations, and data categories. Our executed DPA and its referenced transfer terms identify the applicable safeguard for each destination. We assessed Schrems II risks and documented supplementary measures, including the tenant controls enabled for this flow.” Replace that template with your counsel’s actual conclusion and current artifact versions.

​
Tenant-owned decision: Orbit surfaces evidence, you make the call

Orbit surfaces the registry, DPA, security controls, and location information. The controller’s judgement on whether a transfer occurs, which mechanism applies, and whether supplementary measures are sufficient remains yours. Orbit does not certify your Art. 30 register, choose your derogation, perform a transfer-impact assessment on your behalf, or guarantee that a particular configuration satisfies GDPR for your processing. Keep the decision, evidence versions, and review date in your own compliance records.