In a major ruling on July 16 (see press release), the Court of Justice has provided us with guidance on what it considers to be “an adequate level of protection” for personal data transferred to a third country under the GDPR.
It ruled on the inadequacy of the levels of protection guaranteed by the Privacy Shield (USA), for which mere adherence is not sufficient.
On the other hand, it confirms that the standards data protection clauses (cf. recital 81 GDPR and 2010/87/EC Decision) provide an adequate level of protection.
Remember to check your contracts and assess the level of data protection in the recipient country.