International data transfers
What leaves the EEA, what does not, and under which instruments
A page written to be read by whoever has to sign. It sets out the status of each delivery hub and the applicable instrument, without hiding the case that suits us least.
On Brazil, so there is no doubt
Brazil holds no European Commission adequacy decision. The LGPD brings the Brazilian framework closer to the European one, but it does not substitute for adequacy that does not exist. Any transfer requires standard contractual clauses and a transfer impact assessment.
There are three situations, and only three
Inside the EEA
The operation runs in Portugal or Poland. There is no international transfer, so there is no instrument to prepare and no assessment to carry out.
No instrument required
Country with an adequacy decision
The European Commission has recognised the country as offering an adequate level of protection. The transfer is possible without an additional instrument.
Adequacy decision
Third country without adequacy
This covers Brazil, Uzbekistan, the Philippines, Angola, Mozambique and the remaining hubs. The transfer rests on standard contractual clauses plus a transfer impact assessment.
Standard contractual clauses and a transfer impact assessment
Status of each delivery hub
This table is generated from the same source that feeds the map, the destination pages and the calculator, so none of them can say anything different from the others.
| Hub | Country | Status | Applicable instrument |
|---|---|---|---|
| Lisbon | Portugal | European Economic Area | None. There is no international transfer. |
| Porto | Portugal | European Economic Area | None. There is no international transfer. |
| Warsaw | Poland | European Economic Area | None. There is no international transfer. |
| Toronto | Canada | Adequacy decision | European Commission adequacy decision. |
| Accra | Ghana | Third country, no adequacy | Standard contractual clauses and a transfer impact assessment. |
| Bogota | Colombia | Third country, no adequacy | Standard contractual clauses and a transfer impact assessment. |
| Mexico City | Mexico | Third country, no adequacy | Standard contractual clauses and a transfer impact assessment. |
| Istanbul | Turkiye | Third country, no adequacy | Standard contractual clauses and a transfer impact assessment. |
| Johannesburg | South Africa | Third country, no adequacy | Standard contractual clauses and a transfer impact assessment. |
| Kampala | Uganda | Third country, no adequacy | Standard contractual clauses and a transfer impact assessment. |
| Luanda | Angola | Third country, no adequacy | Standard contractual clauses and a transfer impact assessment. |
| Manila | Philippines | Third country, no adequacy | Standard contractual clauses and a transfer impact assessment. |
| Maputo | Mozambique | Third country, no adequacy | Standard contractual clauses and a transfer impact assessment. |
| Nairobi | Kenya | Third country, no adequacy | Standard contractual clauses and a transfer impact assessment. |
| Praia | Cape Verde | Third country, no adequacy | Standard contractual clauses and a transfer impact assessment. |
| Santo Domingo | Dominican Republic | Third country, no adequacy | Standard contractual clauses and a transfer impact assessment. |
| Sao Paulo | Brazil | Third country, no adequacy | Standard contractual clauses and a transfer impact assessment. |
| Tashkent | Uzbekistan | Third country, no adequacy | Standard contractual clauses and a transfer impact assessment. |
Status refers to the personal data transfer framework and not to any assessment of the hub's quality. This information describes the applicable framework and does not constitute legal advice.
The choices that are yours
The first is the data category. If it includes health data, children's data, or data your regulator treats as specially sensitive, the recommendation is the EEA-only model, and we say so even when it makes the proposal more expensive.
The second is the boundary. Many operations can run outside the EEA on pseudonymised data or on a restricted subset, keeping what is sensitive in Portugal. That boundary is defined before the operation opens, with the categories written down, rather than discovered in an audit.
The third is what happens when circumstances change. Standard contractual clauses require reassessment when the context in the destination country shifts. That sits in the contract, with who reassesses and within what period.
This page describes the framework we apply. It is not legal advice and does not replace the analysis of your data protection officer or your lawyers.
Frequently asked questions
Does Brazil have an adequacy decision?
No. Any transfer requires standard contractual clauses and a transfer impact assessment. The LGPD helps but does not substitute for adequacy.
Which hubs are inside the EEA?
Portugal and Poland. All the others require a transfer instrument.
Can we require that nothing leaves the EEA?
You can, and for health data it is what we recommend. It is the most expensive model and we say so before the proposal.
Who carries out the transfer impact assessment?
We prepare it and share it with you. The final decision to proceed rests with the controller, which is you.
What happens if the country situation changes?
The clauses require reassessment. The contract defines who reassesses and within what period.
Do you sign the European Commission standard contractual clauses?
Yes, the modules applicable to the controller to processor relationship.
Can data be pseudonymised before it leaves?
In many operations it can, and it is frequently the design we recommend to reduce what leaves.
Is this legal advice?
No. It is a description of the framework we apply, to be checked by your lawyers.
Where do we request the documentation?
By email to info@corpshore.solutions, naming the operation concerned.
Which instrument your combination requires
Choose the kind of data the work touches and where you want it done. The tool says which transfer instrument is required, or that the combination is one we do not build.
What the combination requires
No instrument: it stays inside the European Economic Area
There is no international transfer to document. A data processing agreement is still required, but no standard contractual clauses and no impact assessment.
This tool is guidance, not legal advice. The decision to proceed rests with the controller and should be taken with its own legal support.
The rule by data category:
- Ordinary personal data
- You need the processing agreement, the standard contractual clauses in the applicable modules, and a documented transfer impact assessment analysing local authority access to the data. The decision to proceed rests with the controller.
- Customer financial data
- You need the processing agreement, the standard contractual clauses in the applicable modules, and a documented transfer impact assessment analysing local authority access to the data. The decision to proceed rests with the controller.
- Special categories
- The destination country holds an adequacy decision, so the transfer is treated as intra-European. The processing agreement remains, as does the duty to reassess if the decision is revised.
- Health data
- For this category of data, no instrument makes this destination defensible in practice. We say no rather than writing an assessment nobody would want to defend to a regulator.
- Public sector data
- For this category of data, no instrument makes this destination defensible in practice. We say no rather than writing an assessment nobody would want to defend to a regulator.
Let us look at the numbers for your case
Tell us which processes you want to outsource, in which languages and at what volume. We come back with a euro estimate and an operating design, with no commitment.
We reply within 6 hours on working days. If you would rather write: info@corpshore.solutions