# Rights and obligations for data transfers between EU sites Canonical: https://x25pronto.at/en/blog/rechte-und-pflichten-beim-datentransfer-zwischen-eu-standorten.html VW Tiguan R · 320 PS 4MOTION · discreet · direct DIRECT COURIER · NO TRANSHIPMENT · MON–SUN Austrian courier drivers. No detours. Even overnight. x25pronto Austria carries approved goods shipments by car, van or Van XL personally and without unnecessary transhipment. Direct and overnight trips can be booked Monday to Sunday – subject to availability in the booking calendar. [Calculate price](https://x25pronto.at/en/#quote)[How overnight works](https://x25pronto.at/en/overnight.html) Direct Mon–Sun Overnight Mon–Sun Car & van up to 1,000 kg COURIER INSIGHTS # Rights and obligations for data transfers between EU sites How businesses can transfer personal data between EU sites lawfully: GDPR basics, documentation duties, cross-border details and practical security measures. 14 September 2026 ## Quick answer Data transfers between EU sites are primarily governed by the EU General Data Protection Regulation (GDPR). Controllers and processors must document purposes, legal bases and suitable technical and organisational measures. Transfers inside the EU do not trigger extra third-country rules, but transparency, documentation and accountability remain mandatory. ## Why the GDPR matters The GDPR sets the rules for processing personal data in the EU. For transfers between EU sites the GDPR still applies. Companies must name legal bases and processing purposes. Controllers are accountable and must keep records. ## Define roles: controller vs. processor Distinguish controllers and processors early. The controller decides purposes and means. External services, such as IT support or couriers, can be processors. Define roles and obligations in written agreements, for example in data processing agreements (DPAs). ## Documentation and accountability Maintain a record of processing activities (Article 30 GDPR). Document data types, purposes, recipients and retention. Record implemented technical and organisational measures (TOM): encryption, access restrictions and logging. Conduct data protection impact assessments (DPIAs) when processing poses high risk. ## Cross-border specifics inside the EU There are no extra approvals needed for transfers inside the EU as there are for third countries. Still, coordinate with local teams: transfers from Graz to Vienna or Wien to Warsaw should respect local rules and include clear information to data subjects about recipients and purposes. Engaging supervisory authorities can help for complex cases. ## Implementing technical and organisational measures Use encryption in transit and at rest. Employ TLS for transfers and limit access using least-privilege. Maintain backups and test restoration. Keep written records of TOMs to support audits and demonstrate compliance. ## Responding to data breaches If a breach occurs, assess notification duties under Article 33 GDPR. Notify supervisory authorities when required and inform data subjects if there is a high risk to their rights. Record incident details, affected data and remediation steps. ## Frequently asked questions Do I need special approval for transfers between EU countries? No. Transfers inside the EU do not require special approvals. The GDPR applies, however, and requires documentation, a legal basis and appropriate security measures. When is a DPIA required? A DPIA (data protection impact assessment) is necessary when processing is likely to result in a high risk to individuals’ rights and freedoms, such as systematic monitoring or large-scale processing of sensitive data. Should employees be informed about transfers? Yes. Data subjects must receive clear information about purposes, recipients and legal bases. This is typically done via privacy notices or internal policies. How important is encryption for transfers? Encryption reduces the risk of unauthorized access. It is part of recommended technical and organisational measures, especially for personal data. ## Plan a courier trip in Austria x25pronto Austria carries small and well packed shipments by car. Businesses can choose a direct courier trip or overnight service. Route, timing and shipment details can be entered online before booking. The guide price is then shown for the planned courier order. [Direct courier →](https://x25pronto.at/en/direct-courier.html)[Overnight →](https://x25pronto.at/en/overnight.html)[Services →](https://x25pronto.at/en/services.html)[Calculate guide price →](https://x25pronto.at/en/#quote) ### Key points from this article Rights and obligations for data transfers between EU sites. Why the GDPR matters The GDPR sets the rules for processing personal data in the EU. For transfers between EU sites the GDPR still applies. Define roles: controller vs. processor Distinguish controllers and processors early. The controller decides purposes and means. External services, such as IT support or couriers, can be processors. Documentation and accountability Maintain a record of processing activities (Article 30 GDPR). Document data types, purposes, recipients and retention. Cross-border specifics inside the EU There are no extra approvals needed for transfers inside the EU as there are for third countries. Implementing technical and organisational measures Use encryption in transit and at rest. Employ TLS for transfers and limit access using least-privilege. Plan a suitable trip Use the advice in this article to prepare your shipment. Then check the route, available times and guide price for the specific trip. [Direct courier](https://x25pronto.at/en/direct-courier.html) · [Small shipments](https://x25pronto.at/en/small-shipments.html)