International data transfers

Using a cloud service, a payroll application or a support center abroad is an international data transfer. The law allows it only where adequate protection is guaranteed at the destination, or is specifically provided for that transfer (Article 39).

1. Adequacy decision (Article 40)

A transfer is allowed where the recipient is in a state, territory or sector that ensures an adequate level of protection. That level is determined by a decision of the Commissioner, which is published.

2. Appropriate safeguards (Article 41(1))

Without an adequacy decision, a transfer may take place if the controller or processor provides safeguards and data subjects have enforceable rights and effective legal remedies. Without specific authorization, these safeguards may be:

• Standard data protection clauses published by the Commissioner.
• Binding corporate rules approved by the Commissioner (Article 42).
• A code of conduct or certification mechanism approved by the Commissioner, together with binding commitments by the recipient.
• A legally binding instrument between public authorities.

With the Commissioner's authorization, safeguards may also be provided by contractual clauses drafted by the parties themselves (Article 41(2)).

3. Derogations for specific situations (Article 41(3))

• The data subject has given informed and explicit consent after being told of the risks of the transfer.
• The transfer is necessary for a contract with the data subject or in their interest.
• The transfer is necessary to protect vital interests.
• The transfer is necessary for an important public interest.
• The transfer is necessary to exercise or defend a right before a court or public authority.

In practice

List the suppliers that store or access data outside Albania, decide for each which of the three routes the transfer relies on, and record it in the record of processing activities, as Article 27 requires.