Assessment of Appropriate Level of Protection

The transfer of personal data to a country outside the EU is only possible if that other country offers an “adequate level of protection”.

Whether there is an adequate level of protection is assessed by the controller (the person who determines the purpose and means for the use of personal data) on the basis of the European directive. If this Directive establishes that the other country offers an adequate level of protection, the controller will in principle be allowed to assume this. If it is determined in the Directive that the other country does not offer an adequate level of protection, the controller will in principle have to state that transfer is not permitted.