The concept of an international transfer is orthogonal to other processing. The GDPR does not restrict the concept of transfers to those where the source is a controller. Instead:
- the source of an international transfer can be a data subject, controller, or processor (GDPR does not mention or restrict the source)
- the target of an international transfer can be (per Recital 101)
- a controller or processor in a third country
- an international organization in the sense of Art 4(26)
So yes, if someone (controller, processor, data subject) enters information in the website of an international organization that is an international transfer of this data. That international organization acts as the data controller here. Nothing in the GDPR provides a blanket exception from data controller responsibilities for international organizations.
It is not impossible that a data subject of some processing is simultaneously the controller responsible for that data processing. For example, a sole trader offers some service that involves personal data, and is themselves a user of this service. However, in such a scenario the data subject rights become meaningless because the subject/controller can satisfy these rights directly (you cannot violate your own rights). In practice, it is more useful to assume that the data subject and the data controller are distinct entities.
Who the controller is in your scenario depends solely on who meets the Art 4(7) definition: who determines the purposes of processing? And what are these purposes?
- The international organization determines the purposes for how this data is processed, it is therefore potentially a controller.
- But the processing purposes must fall under Union or Member state law (compare Art 2(2), Art 4(7)).
- If the processing purposes fall outside of Union or Member State law, then the GDPR does not apply and the international organization cannot be treated as the controller for that processing.
- Such processing would then have no controller in the sense of the GDPR.
So assuming that some specific processing activity by an international organization is not subject to the GDPR, would sending personal data to this organization still be a transfer?
Generally yes, but it is the controller's job to ensure the safety of this transfer (Art 44). So we have to distinguish two cases:
- personal data is transferred from a controller to the international organization that is not a controller for this processing. Here, the controller is responsible for compliance and must protect the transfer pursuant to chapter 5.
- personal data is transferred directly from a data subject to the international organization that is not a controller for this processing. Here, no controller exists, and the entire transfer falls out of scope of the GDPR.
For you, this means that you should check whether the processing really falls outside the scope of Union or Member State law.
- If the processing is within scope of the GDPR, then the international organization is a controller, and it must comply with the requirements for international transfers as per chapter 5.
- If the processing falls out of scope of the GDPR, no compliance requirements exist, also not any requirements about international transfers.