Transfer of data

Answer: In order to be able to transfer personal data outside the EEA to countries without an adequacy decision such as India, as a data processor, first you need the authorization from the controller to do so and you have to have in place one of the safeguards required by Chapter V of the EU GDPR.

2. Also, the data is originating from India and is being returned to India. Individuals are applying (sending personal) info to the controller. We are then processing the data and replying directly to the individual in India. Is this even classified as a transfer to a third country if the da ta is coming from India and returned to India?

Answer: If the data exporter is an entity established in India, the transfer outside India to the EU or anywhere else does not constitute a cross border data transfer in the sense of the EU GDPR. If you want to find out more about cross border data transfers, check out our webinar “How to make personal data transfers to other countries compliant with GDPR” (https://advisera.com/webinars/how-to-make-personal-data-transfers-compliant-with-gdpr-free-webinar-on-demand/).