On the 11th of November, the European Data Protection Board (‘EDPB’) issued its recommendations on the types of supplementary measures that organisations can adopt to ensure that their international data transfers are compliant with the GDPR. The recommendations, adopted by the EDPB, will now be submitted for public consultation.
In our data privacy summer series of webinars (recordings of which can be found here), we discussed the implications of the recent Schrems II decision, including the requirement for supplementary measures to protect certain international data transfers, and have been awaiting this guidance on what form these measures could take from the EDPB since that decision.
The good news for organisations is that Annex 2 of the recommendations sets out a number of helpful international data transfer use cases, accompanied by a recommended supplementary measure that could be employed by an organisation in order to ensure an essentially equivalent level of protection to that guaranteed under the GDPR. However, it also gives example use cases where no form of supplementary measure could ensure an essentially equivalent level of protection and notes that in these cases, transfers of personal data would not be permitted.
Any organisation making transfers of personal data outside the EEA to a country that does not benefit from an adequacy decision from the European Commission should review this guidance and assess the implications for its current and future data flows.
If you would like help with this exercise, or in understanding the implications of the recommendations or the Schrems II decision, our data privacy team would be delighted to assist you.
David Goodbrand
Partner
Commercial Contracts
David specialises in advising clients on outsourcing arrangements, IP licensing, complex commercial contracts, fintech and the use of information.
Written by
Related News, Insights & Events
Error.
No results.
AI in the workplace masterclass: A practical overview of what employers need to know
13/11/2025 - online webinar
While AI can help employers and employees perform many workplace functions, it can also pose risks for different aspects of a business. Join our masterclass to learn more.
Appeal deadlines in arbitration – Court of Appeal provides guidance on when an award is “rendered”
15/09/2025
Clear language is essential when drafting an arbitration agreement – ambiguous wording can lead to unforeseen consequences.
Cyber Breaches: is monitoring ransom payments the solution?
11/09/2025
Ransomware continues to be a fast-growing and hugely damaging form of cyber attack for organisations and the Government is taking action to manage this threat.
{name}
{properties.pageSummary}
{properties.eventName}
{properties.pageDate|date:dd/MM/yyyy}{properties.shortDescription}
{properties.headline}
{properties.pageDate|date:dd/MM/yyyy}
{properties.shortDescription}
