Abstract

The articles outlines issues connected with the new principles of personal data transfers to third countries or international organizations in the General Data Protection Regulation. In particular, it discusses the adopted solutions introducing three interdependent and hierarchically arranged cases in which data transfer by the exporting administrator is allowed. Firstly, transfer may be based on a decision of the European Commission finding the level of protection in a third country to be adequate; secondly, if there is no such decision, when appropriate safeguards for personal data protection are guaranteed; and thirdly, in the absence of the above, in one of the situations as to which the Regulation provides for exemptions or derogations. The discussed regulation is not revolutionary, it introduces, however, a number of new legislative solutions aimed at facilitating data transfers with the high level of personal data protection being guaranteed.