You probably already have a transfer, you just did not call it one
A third-country transfer rarely starts with someone sending a file abroad. It usually starts with a tool. Marketing sets up a newsletter list, HR uses an applicant portal, sales uses a CRM. If one of these providers, or one of its sub-processors, processes the personal data outside the EU, that is a transfer to a third country.
Who counts as the exporter depends on the route the personal data takes. If you contract a provider outside the EU directly, it is you. If a provider in the EU passes the personal data on to its own sub-processor in a third country, it is the provider. Article 44 GDPR binds controllers and processors alike to the rules of Chapter V. Your own responsibility as controller remains in both cases, because you must be able to demonstrate compliance with the GDPR (Article 5(2) and Article 24(1)).
So the first practical step is not a legal one. You need a list of your providers, with two facts for each. Where is the personal data processed? And who are the sub-processors? Both are in the data processing agreement or its annex, not on the provider's product page.
The order in which you check
Chapter V of the GDPR sets a fixed sequence.
First, is there an adequacy decision? Under Article 45 the European Commission can decide that a third country offers an adequate level of protection. If such a decision covers the country and the specific case, the transfer needs no specific authorisation. Article 46 then does not come into play.
Second, if not, Article 46 applies. Paragraph 2 lists six instruments that can be used without a specific authorisation from a supervisory authority. The one you will meet most often is the Commission's standard contractual clauses. Others include binding corporate rules (BCRs), an approved code of conduct under Article 40 and an approved certification mechanism under Article 42. The last two only count together with binding and enforceable commitments from the recipient in the third country.
Third, the instrument alone is not enough. Article 46(1) also requires that enforceable rights and effective legal remedies are available to the people whose data it is. Whether they are depends on the law in the recipient's country. So ask your provider which instrument it relies on, and ask to see it.
What the EDPB's September 2026 summary adds
The European Data Protection Board (EDPB) published a short summary on certification as a transfer tool in September 2026. It covers only this one route under Article 46. The questions it asks still fit almost any provider.
The summary names four duties of the exporter.
Before the transfer, you check the scope. A certification is not a blanket approval. It must be valid, come from an accredited body and cover exactly the processing in question.
In the contract, you make it binding. The contract must bind the importer legally to the rules. It must also give the people whose data it is third-party rights they can enforce before a European court or a data protection authority.
You get a warranty on local law. The importer must warrant, based on a transfer impact assessment, that it has assessed the laws and practices of its country, including government access, and that nothing prevents it from keeping its commitments. Where needed, supplementary measures such as encryption are added. Your own systems must fit those measures.
You settle how authority requests are handled. The importer must notify you promptly of access requests from foreign authorities and challenge disproportionate ones.
The summary puts two questions to the exporter, in substance. Could foreign laws override the safeguards promised? And will you know if a foreign authority demands access to the personal data? Ask both before you sign your next provider contract.
The location of the data centre does not answer the question on its own
"Servers in Germany" is a statement about where data is stored. Article 46(1) asks something else, whether rights and remedies actually work in the importer's country. Those are two different things. The EDPB summary addresses exactly this difference when it asks for an assessment of the laws and practices in the importer's country.
That gives you one concrete question for every provider. Which legal order does the company processing the personal data fall under? And does it also apply to its parent company and its sub-processors? If the data processing agreement does not answer that, ask in writing.
How ETHYX solved this for itself
For our platform, we avoided the situation of a third-country transfer and with it the check. The ETHYX platform runs at netcup in Nuremberg. No US clouds, no US APIs. Our clients' compliance data does not leave the EU.
That does not mean everyone has to do the same. Not every tool has a European alternative, and a transfer based on Article 46 is a regular route. It just does not happen on the side. It takes the instrument, the contract clauses, the assessment of the local law and documentation of all three.
The next step is the same either way. Build a complete list of your providers, with where they process data and who their sub-processors are. Without it, you cannot tell which transfers you have.