1 New SCC Module 1 at 8.7 (similar provisions in Module 2 and Module 3). The position that a transfer between companies in the same non-EEA country requires a safeguard also accords with Article 44 of the GDPR which requires that “any transfer of personal data . . . after transfer to a third country” must take place pursuant to the restrictions in Chapter V of the GDPR.