When are transfer rules relevant for AI?

Article 44: General principle for transfersAI-relevant

Chapter VIn force since 25-05-2018

When AI training data or AI processing involves personal data outside the EEA: cloud hosting with US providers, API calls to foreign AI services (OpenAI, Google), or international cooperation.

AI Act intersection

Transfer rules are relevant when AI training data contains personal data processed outside the EU (cloud hosting, API calls).

AI Act Art. 10→

Official text

Any transfer of personal data which are undergoing processing or are intended for processing after transfer to a third country or to an international organisation shall take place only if, subject to the other provisions of this Regulation, the conditions laid down in this Chapter are complied with by the controller and processor, including for onward transfers of personal data from the third country or an international organisation to another third country or to another international organisation. All provisions in this Chapter shall be applied in order to ensure that the level of protection of natural persons guaranteed by this Regulation is not undermined.

Source: EUR-Lex, Regulation (EU) 2016/679. Official text, reproduced without modification.

Related recitals

(101)

Flows of personal data to and from countries outside the Union and international organisations are necessary for the expansion of international trade and international cooperation. The increase in suc...

(102)

This Regulation is without prejudice to international agreements concluded between the Union and third countries regulating the transfer of personal data including appropriate safeguards for the data ...

Frequently asked questions

← Art. 43: Certification bodies Art. 45: Transfers on the basis of an adequacy decision→