Under what conditions is the transfer of personal data to a third country permitted?

The decisive factor for the permissibility of data transfer to a third country is whether the recipient country has an adequate level of data protection compared to the EU legal framework (Art. 45-47 GDPR). This can be guaranteed, for example, by the EU-US Privacy Shield.
If data is transferred without an adequate level of protection, the provisions of Art. 46 para. 1 GDPR must be observed. According to this, the transfer of data is permitted despite the lack of adequacy decisions, provided that the controller has provided appropriate safeguards for these. If these are also lacking, admissibility can only be established in exceptional cases under Art. 49 GDPR, e.g. through the express consent of the data subject.