Onward Transfer

Onward transfer refers to the practice of transferring personal data from one entity to another subsequent entity, particularly in the context of international data transfers. This term is most commonly used in privacy frameworks like the now-defunct Privacy Shield and current Data Privacy Framework, where it describes the situation when a company that receives personal data from the EU or another jurisdiction then transfers that data to a third party. The recipient organization must ensure that any third party to which it transfers data provides at least the same level of protection as required by the applicable framework. Onward transfers require specific contractual protections, such as ensuring third parties are also bound by equivalent privacy obligations. Under the GDPR, onward transfers are addressed through requirements for sub-processing arrangements and data processing agreements. Companies must conduct due diligence on recipients, implement appropriate safeguards (like Standard Contractual Clauses), and maintain accountability for the data throughout the transfer chain. The concept recognizes that data protection responsibilities don't end when data leaves your direct control—you remain accountable for ensuring adequate protection at every stage of the data's journey.