gdpr international data-protection
International Transfers to a Data Subject
<p>A membership organisation based in the EEA receives membership applications from people based outside of the EEA, in countries which do not have an adequacy decision. During the course of the applications and membership, it needs to communicate with the individuals, including sending them personal data pertaining to themselves or others.</p>
<p>Two questions:</p>
<ol>
<li>Would sending the data to the individual member constitute a restricted transfer?</li>
<li>If so, how could this be done lawfully in accordance with the GDPR?</li>
</ol>
<p>The same principles would apply to an EEA business wanting to send personal data to customers or clients (who are individual data subjects) outside of the EEA in countries for which no adequacy decision had been made.</p>

<p>GDPR chapter 5 which discusses international transfers applies to:</p>
<blockquote>
<p>transfer of personal data which are undergoing processing or are intended for processing after transfer to a third country</p>
</blockquote>
<p>Since you are merely communicating with the data subject but are not exporting the data for processing, I think you can largely set the rules on international transfers aside.</p>
<p>In any case, GDPR Art 49 contains derogations for specific situations. An international transfer is permissible e.g. if the data subject has given informed consent, or if the transfer is necessary to fulfil or prepare a contract with the data subject.</p>
