Can I transfer personal data outside the EU for my product?

Personal data can be imported from other Member States for your product only when this is done under the GDPR. In most circumstances, the GDPR prohibits the transfer of personal data outside the EU unless the latter ensures adequate protection of these data on the basis of the application of transferring compliance which offers adequate and efficient security. 

To legally transfer personal data outside the EU, you have several options:

1. Adequacy decisions: If the transfer is to a third country and the European Commission has decided that the third country ensures an adequate level of protection, there are no further requirements to meet. This is however true not with the entire countries of the world but only to a certain extent.
2. Standard Contractual Clauses (SCCs): These are the standard contractual conditions; this is a pre-approved term by the European commission. When included within the agreement between the data sender and the recipient, SCCs can help to apply suitable protection measures to data transfers.
3. Binding Corporate Rules (BCRs): BCRs issued by the EU data protection authorities are useful for multinational enterprises for intra-organ transfers.
4. Explicit consent: In some cases, you may transfer data based on the consent of the data subject for the transfer given after being informed of the risk.
5. Derogations: Nevertheless, the data can be transferred under certain conditions such as the transfer made for the purpose of carrying out the obligations under a contract.

For the transfer of data regarding your product, it is probable that at some point implementation of all these mechanisms will be required, although you will mainly require DPAs and SCCs that meet GDPR rules. 

Before the transfer of data it might become necessary to establish the necessity of the transfer, determine the adequacy of data protection measures in the recipient country, apply suitable technical and organizational measures both for the protection of the data, and inform the data subjects of the transfer.