Global Privacy Laws and Cross-Border Data Flows
Cross-border questions test whether you can identify the applicable law, the transfer mechanism and the residual risk. The exam favours scenario reasoning over listing treaty names.
GDPR baseline
GDPR reaches non-EU organisations that offer goods or services to, or monitor, people in the EU (Article 3(2)). Transfers of personal data outside the EEA need a Chapter V route: adequacy decision, appropriate safeguards (SCCs, BCRs, approved codes), or a narrow derogation. Since Schrems II, SCCs require a transfer impact assessment covering destination law and surveillance exposure. The EU-US Data Privacy Framework (2023) restored an adequacy route for certified US recipients.
Other regimes you should recognise
- China PIPL: cross-border transfer via CAC security assessment, standard contract filing, certification, or a narrow exception.
- India DPDP: transfers are permitted by default; the government may restrict transfers to notified countries (a negative-list model), and sectoral localisation still applies.
- Brazil LGPD, Singapore PDPA, Japan APPI, Canada PIPEDA and the APEC CBPR/Convention 108+ tools each use adequacy, contracts or consent in different mixes.
Worked example
An Indian IT services firm supports an EU retailer from Pune and its staff can view EU customer records.
- The retailer is controller; the Indian firm is processor.
- Remote access from India is a transfer; India has no EU adequacy finding.
- Use SCC Module 2 plus a TIA; the Article 28 processor terms must sit in the same contract.
- The Article 49 consent derogation is unsuitable for repetitive support work.
- Document the assessment and any supplementary encryption or access controls.
Traps
- Assuming an EU adequacy decision covers a country's outbound transfers.
- Confusing controller and processor duties; the processor notifies the controller, not the regulator.
- Treating SCCs as self-executing without a TIA.
- Using UK data without the UK Addendum or IDTA.