#
Fully harmonised EU transfer regime in force with active AEPD guidance on mechanisms; TIA obligation confirmed via CJEU Schrems II jurisprudence.
Sub-modules (6)
Transfer MechanismsGreen
AEPD's international-transfers guidance confirms the availability of adequacy decisions, SCCs, BCRs, codes of conduct with binding commitments, certification mechanisms, and derogations for transfers outside the EEA.
Claims (1):
- AEPD guidance confirms that, absent an adequacy decision, transfers outside the EEA may rely on Commission-adopted SCCs, controller-adopted SCCs approved by AEPD/the Commission, codes of conduct or certification mechanisms with binding commitments, or derogations for specific situations.
Adequacy ReceivedGreen
Not applicable in the conventional sense: as an EU Member State, Spain processes data under the GDPR directly and does not itself require an inbound adequacy decision from the European Commission.
Absence provenance: unavailable. Searched: Spain adequacy decision received EU Member State.
Adequacy GrantedGreen
The European Commission (binding EU-wide, applicable in Spain) has adopted adequacy decisions for a defined list of third countries and the EU-US Data Privacy Framework (10 July 2023), permitting transfers without further safeguards.
Claims (1):
- European Commission adequacy decisions currently cover a defined set of third countries and the EU-US Data Privacy Framework (adopted 10 July 2023), permitting transfers from Spain without additional safeguards within their scope.
Sccs And BcrsGreen
Commission Implementing Decision (EU) 2021/914 SCCs (in force since June 2021, mandatory replacement of legacy clauses since December 2022) are the principal transfer safeguard mechanism referenced by AEPD.
Claims (1):
- Commission Implementing Decision (EU) 2021/914 SCCs are considered to provide appropriate safeguards under GDPR Art 46(1)/(2)(c) for transfers from an EU data exporter to a non-EU importer; legacy pre-2001/2010-clause contracts ceased to be valid after 27 December 2022.
Transfer Impact AssessmentAmber
Following Schrems II (CJEU C-311/18), exporters relying on SCCs/BCRs must assess destination-country law/practice and adopt supplementary measures where needed — a transfer impact assessment obligation applicable to Spanish exporters.
Claims (1):
- Following Schrems II, SCC-reliant exporters must carry out a transfer impact assessment documenting destination-country law/practice and any supplementary measures needed to protect transferred data.
Data LocalisationAmber
No Spain-specific data-localisation mandate (partial or absolute) was identified in this research pass beyond the general EU cross-border transfer regime.
Absence provenance: unavailable. Searched: Spain data localisation mandate personal data.
Sources and claims (4)
- ConfirmedAgencia Española de Protección de Datos — AEPD guidance confirms that, absent an adequacy decision, transfers outside the EEA may rely on Commission-adopted SCCs, controller-adopted SCCs approved by AEPD/the Commission, codes of conduct or certification mechanisms with binding commitments, or derogations for specific situations.observed
- ConfirmedEUR-Lex — European Commission adequacy decisions currently cover a defined set of third countries and the EU-US Data Privacy Framework (adopted 10 July 2023), permitting transfers from Spain without additional safeguards within their scope.observed
- ConfirmedEUR-Lex — Commission Implementing Decision (EU) 2021/914 SCCs are considered to provide appropriate safeguards under GDPR Art 46(1)/(2)(c) for transfers from an EU data exporter to a non-EU importer; legacy pre-2001/2010-clause contracts ceased to be valid after 27 December 2022.observed
- ConfirmedEuropean Data Protection Board — Following Schrems II, SCC-reliant exporters must carry out a transfer impact assessment documenting destination-country law/practice and any supplementary measures needed to protect transferred data.observed