What is needed before personal data reaches a country outside the European Economic Area.
Article 44
What it asks for
Data may only leave the EU if one of the routes in Chapter V applies, and onward transfers are caught too.
For example
Using a support desk tool whose staff read tickets from India is a transfer, even though no data is posted anywhere.
How Prudence covers it
The transfer register records the exporter, the importer, the country and the route relied on. An activity involving a country outside the EEA with no transfer record is a gap.
Article 45
What it asks for
No further safeguard is needed where the Commission has decided the destination country protects data adequately.
For example
A transfer to Switzerland relies on the adequacy decision for Switzerland.
How Prudence covers it
Choosing adequacy requires the specific decision to be named, so it can be rechecked if the decision is withdrawn.
Article 46
What it asks for
Without adequacy, a safeguard is needed, most commonly the Standard Contractual Clauses, together with enforceable rights for the individuals.
For example
A United States transcription supplier is covered by the standard clauses plus an assessment of the destination country.
How Prudence covers it
Selecting the standard clauses requires the module and the signature date, and prompts for the Transfer Impact Assessment that case law expects.
Article 47
What it asks for
A corporate group may use approved internal rules for transfers within the group, once the authority has approved them.
For example
A multinational moves employee data between its own subsidiaries.
How Prudence covers it
Binding Corporate Rules are recorded as a document with the approving authority and the approval date.
Article 48
What it asks for
A foreign court or authority order is not by itself a reason to hand over data.
For example
A request from an overseas authority is assessed rather than answered automatically.
How Prudence covers it
Requests of this kind are logged as their own record type with the assessment and the decision.
Article 49
What it asks for
In limited cases, such as explicit consent or the performance of a contract, a one off transfer may go ahead without a safeguard. These are exceptions and cannot be the routine answer.
For example
Sending a booking to a hotel outside the EU at the traveller's request.
How Prudence covers it
Selecting a derogation requires the specific ground and a note on why it is occasional. Repeated use of a derogation for the same activity is raised as a gap.