A company transferred my data outside the EU.

What the Law Says

The transfer of your personal data outside the European Union is strictly regulated under Ireland’s data protection framework, which incorporates the EU General Data Protection Regulation (GDPR) and the Data Protection Act 2018.

The Data Protection Act 2018 gives effect to the GDPR in Ireland. Section 38 specifically addresses international transfers of personal data. It requires that such transfers can only occur if they meet strict conditions ensuring your data remains protected to a standard essentially equivalent to that within the EU.

This means a company must rely on an approved transfer mechanism — for example, an EU Commission 'adequacy decision' for the destination country, Standard Contractual Clauses (SCCs), Binding Corporate Rules (BCRs), or specific derogations (like your explicit consent or necessity for contract performance).

If the transfer does not meet these requirements, it is unlawful — and you may lodge a complaint with the Data Protection Commission (DPC), Ireland’s supervisory authority.

Statutory Text

A controller or processor shall not transfer or otherwise make available personal data to a third country or international organisation unless the conditions set out in Chapter V of Regulation (EU) 2016/679 are met.

— Data Protection Act 2018, s. 38 — International transfers of personal data

What to Do

Sources