This article reviews the issues to be considered when companies transfer personal data outside the EEA and some of the recent developments in the area, including the European Court of Justice decision invalidating the safe harbor regime and its aftermath.