[Enforcement library](/enforcement) # International data transfers: where personal data can be reached from In these GDPR decisions, where data could be reached from mattered, not only where the server sat. The library records three large decisions on transfers to the United States and China. Issue · 3 cases in the library · Source review: 19 October 2026 - What the issue is - Why regulators and plaintiffs care - What to check in your own systems - Cases in the library - Sources and limits ## What the issue is Personal data can leave the EEA through storage abroad, a group company's access or overseas support staff. In these decisions the authorities looked at the legal mechanism relied on and whether the data was protected in practice. The DPC found that [Meta Ireland](/enforcement/meta-eu)'s EU to US transfers infringed Article 46(1) despite standard contractual clauses and supplementary measures, with a EUR 1.2 billion fine. ## Why regulators and plaintiffs care Hosting location did not settle the question. The DPC fined [TikTok](/enforcement/tiktok-china-transfers) EUR 530 million over EEA data transfers to China and transfer transparency, where remote access from China was at issue. The Dutch authority fined [Uber](/enforcement/uber-eu-us-transfers) EUR 290 million over transfers of European drivers' data to the United States without the required safeguards. ## What to check in your own systems ### In the repository - Inventory backend storage, replication and group-company access, not only browser destinations. - List remote administrative and support access by location. ### In the browser and network - Map third-party domains contacted by your site and apps to the companies and countries behind them. ### With the people responsible - Keep records of the mechanism and supplementary measures relied on for each transfer. - Reconcile transfer notices with actual hosting, support and access arrangements. - Have counsel assess third-country law for each route. ## Cases in the library 3 cases in the library are tagged with this issue, newest first. Each page has the record, the source and its procedural status. - [TikTok](/enforcement/tiktok-china-transfers): An EEA hosting location did not settle the question of remote access from China. Irish Data Protection Commission (DPC) · Decision 2 May 2025 · DPC decision and conditional transfer order; later appeal or stay status not established. - [Uber](/enforcement/uber-eu-us-transfers): Driver-data transfers needed safeguards beyond a US server location. Dutch Data Protection Authority (Autoriteit Persoonsgegevens) · Decision 22 July 2024 · Administrative fine; later objection or appeal outcome not established. - [Meta Ireland](/enforcement/meta-eu): Standard contractual clauses did not cover US surveillance access to Facebook data. Irish Data Protection Commission · Decision 12 May 2023 · DPC decision of 12 May 2023. ## Sources and limits The sources for each case are on its case page. [Read how to use the library](/enforcement#how-to-read). Source review: 19 October 2026. This page groups the cases Inth has tagged with this issue and summarises each record at its procedural stage. An allegation is not a finding, and a settlement does not establish liability after trial. Tentative rulings are labelled and may change at the hearing. Inth assigns the issue labels and implementation checks. It is not legal advice. Inth wrote the technical checks; they cannot decide which laws apply or prove compliance. ### Does an EU data centre avoid a transfer? Not on its own in these records. \[TikTok\](/enforcement/tiktok-china-transfers) concerned remote access from China despite EEA hosting. ### Are standard contractual clauses enough? The DPC found them insufficient on the facts in \[Meta Ireland\](/enforcement/meta-eu). Counsel assesses each transfer. ### Is this only for large platforms? The three records here involve large companies. Whether and how the transfer rules apply to you is a question for counsel.