A membership organisation based in the EEA receives membership applications from people based outside of the EEA, in countries which do not have an adequacy decision. During the course of the applications and membership, it needs to communicate with the individuals, including sending them personal data pertaining to themselves or others.
- Would sending the data to the individual member constitute a restricted transfer?
- If so, how could this be done lawfully in accordance with the GDPR?
The same principles would apply to an EEA business wanting to send personal data to customers or clients (who are individual data subjects) outside of the EEA in countries for which no adequacy decision had been made.