What it asks for. Transfers of personal data to a third country or an international organisation may only take place if the conditions in Chapter V are met, including for onward transfers. The aim is that the level of protection guaranteed by the regulation is not undermined when data leaves the European Economic Area.
In practice. Organisations map where personal data goes, including access from outside the EEA by vendors and support teams, and identify the transfer mechanism for each flow, such as an adequacy decision, standard contractual clauses or binding corporate rules. Where safeguards are used, a transfer impact assessment and supplementary measures are typically expected. Evidence includes a transfer register, contracts and assessments.
Common gaps. Remote access by support staff in third countries is often not recognised as a transfer. Sub-processor chains also create onward transfers that are not tracked.