Data Privacy
GDPR Data Transfer Rules 2026: SCC, BCR, Adequacy Decision Tree
Meta €1.2B fine. 15 adequate countries (Switzerland renewed 2024). SCC vs BCR vs DPF decision tree + Transfer Impact Assessment template inside.
May 23, 20268 min read
78 articles
Meta €1.2B fine. 15 adequate countries (Switzerland renewed 2024). SCC vs BCR vs DPF decision tree + Transfer Impact Assessment template inside.
Article 5(1)(b) compatible-use test. 7 enforcement cases (€100M+ collectively). Purpose documentation template + CNIL/EDPB compatibility criteria 2026.
Art. 20 applies only with consent/contract + automated processing. JSON/CSV/XML format. Provided vs derived data + 30-day response deadline workflow.
Retention periods by sector: HR 5y, customers 3y, accounting 10y. Amazon €746M case. Article 5(1)(e) deletion rules + retention policy template.
Redirects to the full GDPR Article 28 page.
Redirects to the storage limitation principle guide.
GDPR Article 16 gives data subjects the right to have inaccurate personal data corrected and incomplete data completed. Procedure, deadlines, and exceptions.
GDPR Article 24 imposes the accountability obligation on the controller. Risk-based approach, technical and organisational measures, documentation, demonstrability.
GDPR Article 27 requires non-EU controllers targeting EU data subjects to designate an EU representative. Obligations, exemptions, and how to comply in 2026.