There are some “exceptions” which may – under strict conditions – allow for the transfer of personal data to a third country in absence of an adequacy decision, adequate safeguards or binding corporate rules (article 49.1 GDPR).

One of these exceptions can be invoked when the data subjects have given their unambiguous consent to the transfer of their data to such a country, when the transfer is necessary to perform a contract with the data subject or when the data come from a public register intended to inform the public (for example telephone book, trade register). These exceptions should be interpreted restrictively and cannot constitute the normal framework for data transfers, especially massive and repeated data flows. For this type of data flows, it is therefore recommended to quickly come to a contractual solution, because in this case the recipient of the data enters into a legal commitment in order to protect the data and individuals are offered legal safeguards.