In the light of the Snowden revelations in 2013, Maximilian Schrems instituted the proceedings against the Irish Data Protection Commissioner which resulted with the invalidation of the Safe Harbour Agreement by the CJEU. The Safe Harbour Agreement, the framework under which EU citizens’ personal data were being transferred to the US, was replaced by the EU-US Privacy Shield which put in place rules and procedures for more effective protection of personal data. Apart from the adequacy decisions such as Safe Harbour and Privacy Shield, the Data Protection Directive envisages adequate safeguards, such as contractual clauses, binding corporate rules and derogations as bases for transfer of personal data to third countries. Despite the fact that these bases are maintained in the General Data Protection Regulation, its entry into force in May 2018 brought some changes in this respect. It was already suggested that the EU-US Privacy Shield will have to be significantly amended. Furthermore, the validity of standard contractual clauses will be inspected by the CJEU since the Irish High Court decided to refer the question for the preliminary ruling on this matter in October 2017. This paper analyses the bases and conditions for transfer of personal data to third countries, novelties introduced by the new General Data Protection Regulation and pinpoints the matters which might present the greatest challenge for efficient data protection, the area of EU law surrounded by much controversy.