When transferring personal data to countries outside the EEA organization should take additional measures to ensure a sufficient degree of protection. The GDPR offers specific tools, including common contract provisions, legally obligatory business policies, or reliance on an adequacy finding, to make legal cross-border transfers easier.