Yes, but the receivers have to live up to certain data protection standards. The GDPR permits personal data to be transferred to non-EU organizations and countries which have been found by the European Commission to provide an “adequate” level of protection or under certain circumstances, such as by use of standard contractual clauses or binding corporate rules (BCRs).