International Data Transfers and Third-Party Management
Cross-border transfers require a transfer mechanism: adequacy decisions, standard contractual clauses (SCCs), binding corporate rules, or specific derogations. Even with a mechanism, a transfer impact assessment may be needed to evaluate the destination's legal environment and supplementary measures. Onward transfers must be controlled contractually.
Third-party management starts with due diligence: assess the vendor's security and data protection posture before onboarding. Contracts must include processor obligations - instructions, confidentiality, security, sub-processor controls, assistance with rights and breaches, deletion/return, and audit rights. Monitor performance and review periodically.
Traps
- Assuming an adequacy decision covers all processing - it may be limited in scope.
- Forgetting that remote access from a third country can itself be a transfer.
- Treating SCCs as self-executing without a risk assessment.
- Overlooking sub-processor authorisation and flow-down obligations.
Rule of thumb
For any transfer, ask M-A-S: Mechanism (adequacy/SCC/BCR/derogation), Assessment (destination risk), Safeguards (supplementary measures and contractual flow-down).
Worked example: A UK firm uses a US support vendor accessing EU customer data. SCCs are signed, a transfer impact assessment documents risks, encryption and access controls are added as supplementary measures, and sub-processors are listed and approved.