Cross-Border Data Transfers and Vendor Management
What this domain tests
Cross-border transfers and vendor management test whether you can map data flows, select a lawful transfer mechanism, and impose contractual and oversight controls on processors and subprocessors.
Core rules and concepts
- US federal law has no general adequacy regime; transfers are governed by sectoral rules, state law, and contracts. For EU/UK data, common mechanisms include adequacy decisions, the EU-US Data Privacy Framework, Standard Contractual Clauses, and the UK IDTA/Addendum.
- Transfer impact assessment: evaluate destination law, government access, data sensitivity, and supplementary measures such as encryption with customer-held keys.
- Vendor lifecycle: diligence, contract, onboarding, monitoring, renewal, termination. Contracts should cover purpose limitation, security, breach notice, subprocessors, audit rights, data return/deletion, and liability.
- State law: CCPA/CPRA requires contracts with service providers, contractors, and third parties, including specific terms and audit rights.
- Accountability: maintain a vendor inventory and track certifications; a vendor’s self-certification may not cover all entities or data.
Worked example
A US SaaS vendor hosts EU employee data and is not DPF-certified. The company signs SCCs, completes a transfer impact assessment, requires EU-region encryption keys, limits support access, and adds subprocessor notice. It documents the assessment and reviews annually.
Traps that cost marks
- Relying on Privacy Shield, which was invalidated in 2020.
- Assuming a DPA alone authorizes a transfer without a mechanism.
- Missing subprocessor chains and onward transfer obligations.
- Treating vendor security questionnaires as ongoing monitoring.