Any transfer of personal data to a third country or to an international organisation needs a legal ground and under certain circumstances further guarantees according to Art. 44 et seq GDPR:

Art. 44 I 1 GDPR: "Any transfer of personal data which are undergoing processing or are intended for processing after transfer to a third country or to an international organisation shall take place only if, subject to the other provisions of this Regulation, the conditions laid down in this Chapter are complied with by the controller and processor, including for onward transfers of personal data from the third country or an international organisation to another third country or to another international organisation."