International Data Transfers and Cross-Border Compliance
What to know
A transfer occurs when personal data is sent to, or made accessible from, another jurisdiction, including remote access. Understand the transfer mechanisms: adequacy decisions, standard contractual clauses, binding corporate rules, certification codes, and derogations (explicit consent, contract necessity, important public interest, legal claims). Know the requirement for a transfer impact assessment after a validity ruling: assess the destination law, the mechanism, and supplementary measures (encryption, pseudonymisation, contractual and organisational safeguards). Understand onward transfer restrictions and the role of the exporter and importer.
Traps
- Assuming an adequacy decision covers all processing, including sectors the decision excludes.
- Treating remote access from abroad as not a transfer.
- Using derogations as a routine, repeatable mechanism; they are for occasional and non-repetitive transfers.
- Relying on SCCs without a documented risk assessment and supplementary measures.
- Forgetting onward transfers to sub-processors require their own basis.
Worked example
A company uses a cloud provider with support staff in a third country. Rule of thumb: identify the transfer, choose a mechanism (e.g., SCCs), assess destination law, add supplementary measures (encryption at rest with keys held locally, access controls, notification duties), document, and review. If the provider can access decrypted data on request, the assessment is not complete.
Rule of thumb
Map the flow → pick the mechanism → assess the destination → add safeguards → document and review.