Yes.

If the data contains personal data, any transfer to a third country outside the European Economic Area that is not deemed to provide an adequate level of data protection by the European Commission generally requires that the data exporter ensures an adequate level of data protection consistent with Article 44 of the EU General Data Protection Regulation ("GDPR") on transfers.

Jurisdictions that are subject to an adequacy decision from the European Commission and deemed to provide an adequate level of protection are currently: Andorra, Argentina, Canada, the Faroe Islands, Guernsey, the Isle of Man, Israel, Japan, Jersey, Republic of Korea, New Zealand, Switzerland, UK and the Eastern Republic of Uruguay.

If the transfer of personal data from the EU is to a jurisdiction that is not deemed to be "adequate" for the purposes of the GDPR, additional steps may be required such as entering into EU Standard Contractual Clauses and conducting an assessment of the laws and practices of that third jurisdiction in relation to whether those laws/practices would impinge on the effectiveness of the Standard Contractual Clauses. There are also other alternative transfer tools under the GDPR, such as Binding Corporate Rules. Due to a decision of the Court of Justice of the European Union (C-311/18, July 16, 2020 2 Schrems-II) there are issues around providing appropriate safeguards for regular transfers of personal data, especially, to the US, under the GDPR.

A bank has a duty to maintain secrecy under private law on any customer-related facts and evaluations of which it has knowledge. It may only disclose information concerning a customer if it is legally required to do so, if the customer has consented or if the bank is authorized to disclose it. Legal doctrine in Germany is generally to the effect that a bank may use cloud service providers and share information on its clients with these providers if they agree to safeguard any bank secrets.