---
title: "Spain — Cross-Border & Adequacy | Data Protection Monitor"
canonical: https://dataprotection.gi/jurisdictions/spain/cross-border-and-adequacy/
source_html: /jurisdictions/spain/cross-border-and-adequacy/index.html
description: "Spain — Cross-Border & Adequacy: cross_border_and_adequacy Cross-Border & Adequacy 6 sub-modules 4 claims Green ▾ # Fully harmonised EU transfer regime in force with active AEPD guidance on mechanisms; TIA obligat"
generated_at: 2026-10-25T04:46:50Z
content_sha256: a1f636a85aa1d142056dc8fbb8fb6214284ba0e62cc085bc48ac73e24f5d9f8f
generator: "fe-fleet/md-twin@1.0"
---
# Spain — Cross-Border & Adequacy | Data Protection Monitor

### D5Cross-Border & Adequacy6 sub-modules4 claimsGreen▾#

Fully harmonised EU transfer regime in force with active AEPD guidance on mechanisms; TIA obligation confirmed via CJEU Schrems II jurisprudence.

Primary framework GDPR Arts 44-49 + Commission Implementing Decision (EU) 2021/914

Supervisory authority [Agencia Española de Protección de Datos (AEPD)](https://www.aepd.es)

Traffic-light rationale — Green Fully harmonised EU transfer regime in force with active AEPD guidance on mechanisms; TIA obligation confirmed via CJEU Schrems II jurisprudence.

#### Sub-modules (6)

#### Transfer MechanismsGreen

AEPD's international-transfers guidance confirms the availability of adequacy decisions, SCCs, BCRs, codes of conduct with binding commitments, certification mechanisms, and derogations for transfers outside the EEA.

Claims (1):

- AEPD guidance confirms that, absent an adequacy decision, transfers outside the EEA may rely on Commission-adopted SCCs, controller-adopted SCCs approved by AEPD/the Commission, codes of conduct or certification mechanisms with binding commitments, or derogations for specific situations.

#### Adequacy ReceivedGreen

Not applicable in the conventional sense: as an EU Member State, Spain processes data under the GDPR directly and does not itself require an inbound adequacy decision from the European Commission.

Absence provenance: unavailable . Searched: Spain adequacy decision received EU Member State.

#### Adequacy GrantedGreen

The European Commission (binding EU-wide, applicable in Spain) has adopted adequacy decisions for a defined list of third countries and the EU-US Data Privacy Framework (10 July 2023), permitting transfers without further safeguards.

Claims (1):

- European Commission adequacy decisions currently cover a defined set of third countries and the EU-US Data Privacy Framework (adopted 10 July 2023), permitting transfers from Spain without additional safeguards within their scope.

#### Sccs And BcrsGreen

Commission Implementing Decision (EU) 2021/914 SCCs (in force since June 2021, mandatory replacement of legacy clauses since December 2022) are the principal transfer safeguard mechanism referenced by AEPD.

Claims (1):

- Commission Implementing Decision (EU) 2021/914 SCCs are considered to provide appropriate safeguards under GDPR Art 46(1)/(2)(c) for transfers from an EU data exporter to a non-EU importer; legacy pre-2001/2010-clause contracts ceased to be valid after 27 December 2022.

#### Transfer Impact AssessmentAmber

Following Schrems II (CJEU C-311/18), exporters relying on SCCs/BCRs must assess destination-country law/practice and adopt supplementary measures where needed — a transfer impact assessment obligation applicable to Spanish exporters.

Claims (1):

- Following Schrems II, SCC-reliant exporters must carry out a transfer impact assessment documenting destination-country law/practice and any supplementary measures needed to protect transferred data.

#### Data LocalisationAmber

No Spain-specific data-localisation mandate (partial or absolute) was identified in this research pass beyond the general EU cross-border transfer regime.

Absence provenance: unavailable . Searched: Spain data localisation mandate personal data.

Category narrative 54 words

As an EU Member State, Spain applies the GDPR Chapter V transfer regime uniformly: transfers rely on European Commission adequacy decisions, Commission Implementing Decision (EU) 2021/914 SCCs, BCRs, derogations, or ad hoc clauses authorised by AEPD. Post-Schrems II, a transfer impact assessment (TIA) is required for SCC-based transfers. No Spain-specific data-localisation mandate was identified.

Evidence 4

Sources and claims (4)
- Confirmed[Agencia Española de Protección de Datos](https://www.aepd.es/en/rights-and-duties/fulfill-your-duties/measures-compliance/international-data-flows) — AEPD guidance confirms that, absent an adequacy decision, transfers outside the EEA may rely on Commission-adopted SCCs, controller-adopted SCCs approved by AEPD/the Commission, codes of conduct or certification mechanisms with binding commitments, or derogations for specific situations.observed 2026-08-03
- Confirmed[EUR-Lex](https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj/eng/pdf) — European Commission adequacy decisions currently cover a defined set of third countries and the EU-US Data Privacy Framework (adopted 10 July 2023), permitting transfers from Spain without additional safeguards within their scope.observed 2026-08-03
- Confirmed[EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A32021D0914) — Commission Implementing Decision (EU) 2021/914 SCCs are considered to provide appropriate safeguards under GDPR Art 46(1)/(2)(c) for transfers from an EU data exporter to a non-EU importer; legacy pre-2001/2010-clause contracts ceased to be valid after 27 December 2022.observed 2026-08-03
- Confirmed[European Data Protection Board](https://www.edpb.europa.eu/sme/be-compliant/international-data-transfers_en) — Following Schrems II, SCC-reliant exporters must carry out a transfer impact assessment documenting destination-country law/practice and any supplementary measures needed to protect transferred data.observed 2026-08-03