The EU-US Privacy Shield decision was adopted on 12 July 2016 and the Privacy Shield framework became operational on 1 August 2016. This framework protects the fundamental rights of anyone in the EU whose personal data is transferred to the United States for commercial purposes. The framework also brings legal clarity for businesses relying on transatlantic data transfers.

The European Commission has the power to determine, on the basis of article 45 of Regulation (EU) 2016/679 whether a country outside the EU offers an adequate level of data protection, whether by its domestic legislation or of the international commitments it has entered into.

The European Commission can decide that standard contractual clauses offer sufficient safeguards on data protection for the data to be transferred internationally.  It has so far issued two sets of standard contractual clauses for data transfers from data controllers in the EU to data controllers established outside the EU or European Economic Area (EEA). It has also issued one set of contractual clauses for data transfers from controllers in the EU to processors established outside the EU or EEA

DPAs are independent public authorities that supervise, through investigative and corrective powers, the application of the data protection law. They provide expert advice on data protection issues and handle complaints lodged against violations of the General Data Protection Regulation and the relevant national laws. There is one in each EU Member State.  Generally speaking, the main contact point for questions on data protection is the DPA in the EU Member State where your company/organisation is based. However, if your company/organisation processes data in different EU Member States or is part of a group of companies established in different EU Member States, that main contact point may be a DPA in another EU Member State.  

Binding corporate rules are internal rules for data transfers within multinational companies.  Binding corporate rules are like a code of conduct. They allow multinational companies to transfer personal data internationally within the same corporate group to countries that do not provide an adequate level of protection. Binding corporate rules ensure that all data transfers within a corporate group are safe.

The GDPR is now the strongest data protection regime in the world, leading many  to hope that it will set a ‘gold standard’ for other jurisdictions. Globally, there is an increasing growth in data protection laws, many of which have been modelled on  comprehensive guidelines or regulation such as the EU Directive mentioned above, or the OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data3 .According to UNCTAD data protection tracker 4, over 100 countries around the world now have data protection laws in place.