Cross-border data transfers: How to keep GDPR and local privacy rules aligned

Why cross-border data transfers matter more than most teams expect

In an international environment, it is often the case that a company’s data does not stay in one jurisdiction even when the business appears local on the surface. A European SaaS provider might host its platform on US cloud infrastructure, route support tickets through a service center in Asia, and use a Swiss-based analytics tool; each of these connections can involve personal data and potentially qualify as a cross-border transfer.

The problem usually does not arise only in the legal assessment itself, but also in coordinating multiple parties, documents, and jurisdictions. Internal IT, procurement, security, and legal functions often have partially overlapping views of where data is located and who is ultimately responsible.

When that picture is incomplete, organizations risk unlawful transfers, inconsistent contractual protections, and situations where they cannot clearly demonstrate compliance to a supervisory authority. This exposure is particularly high during critical incidents such as data breaches or unexpected government access requests.

Under the GDPR, a cross-border data transfer is not defined in the text itself, but the European Data Protection Board has clarified three cumulative criteria that make a situation a transfer outside the EEA. First, a controller or processor must be subject to the GDPR for the relevant processing, and second, they must disclose personal data to another controller or processor.

Third, that receiving organization must be in a non‑EEA country or be an international organization. This definition is broader than many expect, because it can cover remote support, centralized group reporting, or continuous access to EU-hosted systems from third countries.

In practice, this means that legal teams cannot treat transfers as isolated transactions but as patterns of cross-border access, storage, and processing that evolve as the business changes. From a risk perspective, cross-border transfers cut across legal, operational, financial, and reputational dimensions.

On the legal side, regulators focus on whether individuals’ rights enjoy an essentially equivalent level of protection after data leaves the EEA. Operationally, misaligned transfer arrangements can delay product launches, complicate vendor onboarding, or force last-minute architecture changes when a country lacks adequacy.

Financially, fragmented transfer governance drives duplicated contracts, inefficient vendor choices, and higher outside counsel spend in each jurisdiction. Reputationally, poorly handled transfers—especially where state surveillance or data breaches are involved—are fast-moving stories that general counsel want to avoid.

This is exactly where it makes sense to have the brief, documents, and next steps in one centralized workspace, rather than scattered across emails, spreadsheets, and isolated local advice.

The GDPR framework for international data transfers

Navigating international data transfers requires a deep understanding of the structured pathways set out under European law. The General Data Protection Regulation establishes a clear hierarchy of mechanisms designed to protect personal data when it leaves the European Economic Area.

The basic structure of Chapter V GDPR

Chapter V of the GDPR (Articles 44–50) sets out the general principle for transfers of personal data to third countries or international organizations and the conditions under which such transfers are allowed. Article 44 establishes that any transfer must comply with the GDPR’s overall framework, including data protection principles, rights, and obligations, and must not undermine the level of protection individuals enjoy inside the EEA.

Articles 45 and 46 then provide the two main routes for compliant transfers: adequacy decisions by the European Commission and appropriate safeguards such as standard contractual clauses (SCCs) or binding corporate rules (BCRs). Adequacy decisions are the most straightforward mechanism from an operational point of view because they permit free data flows without additional safeguards.

When the Commission formally recognizes a non‑EU country, territory, sector, or international organization as providing an adequate level of protection, personal data can flow from the EEA to that destination. In effect, such transfers are assimilated to intra‑EU transmissions of data, meaning organizations can treat an adequate country similarly to another Member State.

As of now, adequacy decisions cover jurisdictions such as Andorra, Argentina, Canada, Israel, Japan, New Zealand, the Republic of Korea, Switzerland, the United Kingdom, and participating US commercial organizations. In the absence of an adequacy decision, Article 46 GDPR allows transfers if the controller or processor provides appropriate safeguards and individuals have enforceable rights.

The main transfer tools relevant to private organizations include standard contractual clauses adopted by the European Commission and binding corporate rules approved by competent supervisory authorities. These instruments translate into specific contractual standards, internal policies, and governance structures that must be deployed consistently across the organization's cross-border landscape.

In practice, a combination of document centralization, initial secure AI processing, and involving vetted local experts proves effective in keeping Article 46 tools coherent and up to date. Managing these mechanisms systematically ensures that compliance remains resilient even as international guidelines shift.

Standard contractual clauses and their modernized design

Standard contractual clauses (SCCs) have become the workhorse of cross-border transfers where adequacy is absent, especially in relationships with cloud providers, outsourcing partners, and other vendors located in third countries. Under the GDPR, the Commission may adopt standard data protection clauses ensuring appropriate safeguards, which organizations can incorporate into their contracts.

In June 2021, the Commission issued modernized SCCs that replaced the older sets adopted under the previous Data Protection Directive. These modernized clauses use a modular design covering controller-to-controller, controller-to-processor, processor-to-processor, and processor-to-controller transfers.

The modernized SCCs focus heavily on accountability, transparency, and maintaining GDPR-level protection in countries that may have lower privacy standards. They require both parties to carry out a Transfer Impact Assessment (TIA), considering the laws and practices of the destination country, and to confirm that they have no reason to believe these would prevent compliance.

They also contain more detailed obligations regarding data security, data breach notification, handling government access requests, and restrictions on onward transfers. From a practical standpoint, organizations must embed SCC management directly into their vendor lifecycle from procurement to contract renewal.

For cross-border data transfers involving AI contract review tools themselves, GDPR-sensitive teams increasingly prefer platform architectures that secure, isolate, or anonymize client and counterparty data before analysis to reduce exposure and reinforce minimization. An approach where personal data is stripped or pseudonymized at the technical layer aligns well with SCC obligations on limiting data to what is necessary.

It also reduces the practical risk that foreign authorities accessing AI infrastructure in a third country receive identifiable EU personal data, since the platform can be designed not to process direct identifiers at all. Combining contractual safeguards with architectural choices materially lowers risk for the entire enterprise.

Binding corporate rules and internal group transfers

Binding corporate rules (BCRs) are another key instrument under Article 46, particularly for large corporate groups that need a sustainable mechanism for continuous intra‑group transfers outside the EU. These are internal data protection policies adopted by a group of undertakings engaged in joint economic activities, providing appropriate safeguards for transfers to group members in third countries.

They must include all general data protection principles and enforceable rights, be legally binding, and be enforced by every member concerned. Approval of BCRs involves supervisory authorities through the consistency mechanism, and the European Data Protection Board may issue an opinion before final approval.

In practice, BCRs allow multinational groups to move away from fragmented, bilateral SCC chains and towards a more unified, policy‑based framework that governs intra‑group flows. They are particularly useful where multiple regional hubs, shared service centers, or global IT platforms routinely process EU personal data.

However, designing BCRs that remain aligned with local privacy rules in destinations such as Brazil, China, or Russia is not trivial. Corporate groups require a coherent baseline that meets EU expectations while integrating mandatory local requirements such as local impact assessments, localization, or special sectoral rules.

This is exactly where a centralized ecosystem for cases, documents, and expert inputs can coordinate the different strands of BCR drafting and implementation.

Derogations and exceptional transfers under Article 49

Article 49 GDPR contains derogations for specific situations where neither adequacy nor appropriate safeguards are available, but a transfer still needs to occur. These exceptions cover scenarios such as explicit informed consent, necessity for the performance of a contract, public interest reasons, or the defense of legal claims.

There is also a narrow derogation for transfers based on compelling legitimate interests of the controller, subject to strict conditions and supervisory authority notification. Supervisory authorities and the EDPB consistently stress that derogations must be interpreted restrictively and cannot serve as long-term solutions for routine transfers.

From an operational standpoint, relying on derogations is often a sign that the underlying transfer architecture has not been fully thought through. For example, repeatedly invoking contract necessity for routine analytics or global HR dashboards may be difficult to defend if those activities go beyond what is strictly required to perform the contract.

Legal and compliance teams therefore tend to treat derogations as emergency fallback mechanisms, using them only where no other tool is realistically available. Ensuring that such transfers are clearly documented, limited in scope, and subject to appropriate risk assessments is vital to maintaining compliance.

A structured brief and clear inventory of transfers help to spot where derogations are overused and where more sustainable safeguards should be introduced.

Local privacy regimes and their friction with GDPR transfers

While the GDPR provides a comprehensive baseline, multinational organizations must reconcile these rules with evolving local regimes. The following diagram illustrates how European export bases interact with diverse international frameworks.

The United Kingdom: "Not materially lower" and transfer blacklists

Post‑Brexit, the UK GDPR retains a transfer regime similar to the EU’s but with some notable independent evolutions. Currently, UK controllers may transfer personal data outside the UK if the destination is covered by a UK adequacy decision, or if appropriate safeguards such as the International Data Transfer Agreement (IDTA) or the UK Addendum to the EU SCCs are in place.

Where appropriate safeguards are used, UK controllers must carry out transfer risk assessments (TRAs) to ensure that the post‑transfer protection is essentially equivalent to the UK GDPR. The Data (Use and Access) Bill, introduced in October 2024, proposes to change this approach by introducing a new data protection test for both adequacy decisions and assessments.

Under the proposed Bill, the test is met where the standard of protection in the third country is not materially lower than under the UK GDPR. This standard appears designed to be somewhat more flexible than the EU’s essentially equivalent benchmark, though the exact application is still developing.

The legislation would also empower the UK government to create transfer blacklists, banning transfers to certain countries in the public interest. For organizations operating between the EU and UK, this means that future alignment cannot be assumed, and coordinated cross-border governance must track both sets of rules.

Switzerland: Appropriate level of protection under the FADP

Under the revised Swiss Federal Act on Data Protection (FADP), personal data may only be transmitted abroad if the destination country guarantees an appropriate level of protection. The Federal Council decides which countries meet this requirement and publishes an official list, which is distinct from the EU’s adequacy decisions despite significant overlap.

If a country has not been assessed as providing appropriate protection, cross-border disclosure may still be permitted if data protection can be guaranteed through other appropriate safeguards. These safeguards include standard data protection clauses approved by the Federal Data Protection and Information Commissioner, such as the EU SCCs adapted with Swiss-specific additions.

Controllers must ensure that the recipient complies with these clauses and that the legislation of the third country allows the recipient to fulfill its obligations. For Swiss-based entities handling EU personal data, BCRs recognized by both EU authorities and the Swiss commissioner can be a powerful tool to unify intra‑group transfers.

The FADP also imposes strict information obligations, requiring data subjects to be informed about the destination country and the specific guarantees used if the country lacks adequate protection. Additionally, controllers must maintain an inventory of processing activities that includes countries involved and the guarantees used for cross-border disclosures.

For organizations operating across the EU and Switzerland, aligning these inventories is an obvious efficiency gain that also improves compliance posture.

Brazil: LGPD Resolution 19/2024 and SCCs

Under Brazil’s General Data Protection Law (LGPD), international data transfers from Brazil to a third country are permitted in several cases. These include situations where the Brazilian Data Protection Authority (ANPD) recognizes the third country as providing adequate protection, or where the exporter and importer enter into standard contractual clauses.

Resolution 19/2024, issued in August 2024, implements this framework and approves SCCs for transfers from Brazil without requiring prior ANPD authorization. These Brazilian SCCs cover controller‑to‑controller and controller‑to‑processor transfers and must be used without modification unless alternative clauses obtain direct ANPD approval.

The ANPD may also recognize equivalent standard contractual clauses adopted by other countries, provided they are compatible with the LGPD, although it has not yet indicated whether EU SCCs will be treated as equivalent. This means that multinational organizations must carefully evaluate how to overlay these distinct templates.

Brazilian controllers that rely on contractual clauses must replace existing contracts with the newly published SCCs by August 22, 2025, which creates a concrete migration deadline. For groups processing EU and Brazilian personal data in the same infrastructure, the interplay between these clauses needs to be managed actively to avoid conflicting obligations.

The Regulation also sets out the procedure for ANPD adequacy decisions, requiring the authority to consider compliance with data protection principles and judicial remedies. In practice, a destination may be adequate for the EU but not yet for Brazil, requiring distinct transfer safeguards.

This highlights the importance of having the brief, documents, and next steps around each cross-border project in one place. A centralized workspace allows different regimes to be reconciled without losing track of specific obligations imposed by each authority.

China: PIPL and cross-border transfer mechanisms

China’s Personal Information Protection Law (PIPL) and related regulations have created a detailed, compliance‑heavy framework for cross-border personal information transfers. Under the PIPL, controllers must conduct personal information protection impact assessments (PIPIA) and keep results and processing records for at least three years.

When transferring personal information to a third party overseas, controllers must inform data subjects of the recipient's identity, obtain separate consent, and perform a PIPIA. Cross-border transfers are generally permitted provided controllers have completed one of several legitimizing mechanisms, including a security assessment by the Cyberspace Administration of China (CAC).

Other legitimizing pathways include obtaining certification from a CAC‑accredited agency or putting in place CAC standard contractual clauses. The Regulations on Facilitating and Regulating Cross‑border Data Transfers, effective from March 2024, introduce specific volume thresholds that determine which mechanism is required.

For example, a CAC security assessment is needed if a controller transfers important data, is a critical information infrastructure operator, or transfers non-sensitive data of more than one million people. A China SCC filing is required for transfers involving non‑sensitive information of 100,000 to one million data subjects or sensitive information of fewer than 10,000 people.

For EU‑based organizations leveraging Chinese operations or vendors, this regime adds a layer of local compliance that must be aligned with GDPR transfer tools. This is particularly critical where China SCCs and EU SCCs both apply to the same data flows.

Russia: Data localization and cross-border exports

Russia’s Personal Data Law imposes a strong domestic storage requirement for personal data of Russian citizens. Under these rules, operators that collect such data must initially record, store, arrange, update, and extract that data using databases physically located in Russia.

This localization obligation applies to a broad definition of personal data relating to identified or identifiable Russian citizens. While cross-border transfers remain possible after initial localization occurs, they must comply with specific statutory conditions and notification requirements.

For EU‑based groups that maintain Russian operations, this leads to a complex alignment problem. The GDPR requires ensuring adequate protection or appropriate safeguards for transfers from the EEA, while Russian law demands that Russian citizens’ data be primarily stored domestically before any export occurs.

Navigating these overlapping demands requires a highly coordinated approach to database architecture and contract management. A case-by-case assessment and a multi-layered infrastructure are often necessary to ensure compliance with both European and Russian regulators.

The United States and the EU-US Data Privacy Framework

For many years, the US has been a central point of friction in EU data transfer law due to concerns over government surveillance and limited redress mechanisms. The Schrems II judgment invalidated the EU‑US Privacy Shield and raised doubts about the sufficiency of old SCCs, requiring exporters to conduct case‑by‑case assessments and adopt supplementary measures.

Following reforms and negotiations, the EU‑US Data Privacy Framework (DPF) now provides a new adequacy decision for US commercial organizations that self‑certify and comply with specific obligations. Transfers to DPF‑participating companies can rely on adequacy, while other US recipients must generally rely on SCCs coupled with transfer impact assessments.

The new SCCs have become central for many US transfers, including cloud hosting, SaaS, and analytics. They require exporters and importers to analyze the importer country’s privacy laws, intended transfer safeguards, and handling of public authority access requests, implementing measures to address any identified gaps.

For EU‑based legal and compliance teams, US transfers often represent the most visible example of how GDPR and local rules collide. In these scenarios, technical choices such as encryption, anonymization, and access controls matter just as much as the underlying legal clauses.

This is precisely the type of cross-border problem where a structured, AI‑assisted workflow can help cut through complexity and coordinate the steps from mapping to documentation.

Transfer Impact Assessments and supplementary measures

Following landmark judicial rulings, transfers to non-adequate third countries can no longer rely on paper agreements alone. Organizations must actively evaluate the legal and practical realities of destination countries through structured assessments.

Schrems II and the case-by-case assessment duty

The Court of Justice of the European Union’s Schrems II judgment fundamentally changed how organizations must approach cross-border transfers based on Article 46 tools like SCCs and BCRs. The Court stressed that SCCs do not operate in a vacuum, making exporters responsible for verifying whether the law or practice in the destination country affects the effectiveness of the safeguards.

If the laws of the third country allow public authorities to access personal data in ways that go beyond what is strictly necessary, then SCCs alone may not ensure an essentially equivalent level of protection. In light of Schrems II, both the EDPB and national authorities emphasize that exporters relying on Article 46 tools must conduct a formal Transfer Impact Assessment (TIA).

The objective of a TIA is to assess whether the importer can comply with its obligations under the chosen transfer tool, taking into account local legislation and practices, especially regarding public authority access. Exporters must then document this assessment, decide whether supplementary measures are needed, and implement them before the transfer begins.

Where the assessment shows that no effective supplementary measures can be identified, the exporter must not start transfers or must suspend or terminate ongoing transfers. Documenting this process thoroughly is critical, as supervisory authorities can request to inspect these assessments during audits or investigations.

TIA methodologies and steps

To help organizations operationalize TIAs, regulatory bodies like the CNIL have published guides structured around key questions and practical steps. The assessment must first verify whether there is a transfer of personal data, whether a TIA is necessary, who is responsible, and what the overall scope is.

The implementation of a TIA is typically organized into six clear procedural steps. First, you must map your transfers in detail, identify the specific transfer tool used, and evaluate the legislation and practices of the destination country.

Fourth, you must identify and adopt supplementary measures if necessary, implement those measures, and finally, reassess the level of protection at regular intervals. These steps turn an abstract legal requirement into a structured, audit-ready compliance process.

The EDPB Recommendations on supplementary measures complement this by providing examples of technical, contractual, and organizational measures that can help close identified gaps. Technical measures include strong encryption with keys retained under the exporter’s control, robust pseudonymization, and split processing.

Contractual measures may include detailed obligations on transparency, audit, and notification of legal requests, while organizational measures involve internal policies, training, and governance structures. In practice, TIAs become a central document in cross-border governance, linking legal analysis with technical and organizational realities.

Supplementary measures, data minimization, and AI-enabled processing

In line with GDPR’s principle of data minimization, exporters must verify that the data they transfer is adequate, relevant, and limited to what is necessary for the purposes for which it is processed. Minimizing the amount and sensitivity of data sent abroad significantly reduces the risk that local surveillance or security incidents harm individuals’ rights.

Supplementary measures often leverage minimization by encrypting fields that are not needed, replacing identifiers with pseudonyms, or aggregating data before export. Technical design choices such as automated detection and redaction of sensitive fields align directly with regulatory expectations.

AI systems that process legal documents and contracts can be architected to support minimization and supplementary measures. For example, an AI contract review platform may be built so that client and counterparty names, addresses, and contact details are stripped before analysis, and only structural and semantic information about clauses is processed.

This design reduces the likelihood that foreign authorities accessing the AI infrastructure can obtain meaningful personal data, helping support TIAs for transfers to countries without adequacy. At the same time, AI can accelerate the identification of clauses relevant to transfers, which improves the quality of TIAs and supplementary contractual measures.

In practice, a combination of document centralization, initial AI processing, and involving the right local expert proves effective in getting TIAs done correctly and efficiently.

MicroFAQ: Transfer Impact Assessments in practice

• 1. How do we know whether a transfer requires a TIA?
  A transfer generally requires a TIA when it is based on an Article 46 tool such as SCCs or BCRs, the destination country lacks an adequacy decision, and the data is not covered by an Article 49 derogation. You start by mapping transfers, confirming whether GDPR applies, and identifying the legal basis used, which becomes the trigger for the TIA.

• 2. Who typically leads the TIA process inside a company?
  The exporter subject to the GDPR is responsible, whether acting as controller or processor, often through the data protection officer, privacy team, or legal department. However, the importer must assist by providing information about local law, its processing activities, and security measures, so the TIA becomes a collaborative exercise rather than a unilateral assessment.

• 3. How often should TIAs be revisited?
  TIAs should be re-evaluated at appropriate intervals and whenever developments in the destination country’s law or practices could affect the level of protection. Supervisory authorities expect ongoing monitoring, not a one-off assessment, so a calendar and tracking mechanism for legal changes and case law is essential.

A practical alignment strategy for GDPR and local privacy rules

Achieving seamless compliance across multiple jurisdictions requires shifting from reactive mapping to a proactive governance framework. Organizations can build a resilient operational strategy by focusing on data visibility and structured collaboration.

Mapping transfers and building a reliable inventory

The first step is often not the final legal answer, but a structured brief, the right questions, and a clear overview of the documents and jurisdictions involved. Both the EDPB and practitioners emphasize knowing your transfers as the absolute foundation of compliant cross-border governance.

Mapping all transfers of personal data to third countries can be difficult, especially in large or decentralized organizations, but it is necessary to ensure that data is afforded an essentially equivalent level of protection. Data mapping should identify the types of personal data, the categories of data subjects, purposes of processing, locations of processing, and current safeguards in place.

Under Article 30 GDPR, controllers and processors must maintain records of processing activities that include the categories of recipients to whom personal data has been or will be disclosed. To align this inventory with non‑EU frameworks, organizations must expand their local records to capture specific foreign thresholds.

For example, organizations must track whether a transfer from China involves sensitive personal data or triggers local CAC notification limits. Without a centralized workspace that tracks both GDPR parameters and local statutory indicators, maintaining a dynamically accurate inventory across global operations is nearly impossible.

How to bridge the gap between AI triage and local expert validation

Managing cross-border data flows is fundamentally a coordination challenge across multiple jurisdictions, large document volumes, and internal stakeholders. Treating this as a purely manual legal research task in each country is slow and prohibitively expensive.

Conversely, relying solely on unguided AI generators carries severe risks of hallucination, outdated regulatory limits, or generic language that fails regulatory audit. The optimal operational pathway is a hybrid workflow where secure technology does the heavy lifting, but human expertise makes the final, binding legal assessment.

In this hybrid workflow, secure AI tools first parse the company’s global contract repositories, vendor agreements, and data inventories. The AI identifies which SCC modules are in use, flags missing or outdated TIAs, and highlights countries where localization or filing obligations may be triggered.

The platform then organizes these findings into structured briefs, bringing all relevant contracts, technical security descriptions, and proposed transfer pathways into a single dashboard. This centralization allows for a transparent, upfront assessment of work scope and legal costs, eliminating fragmented billing across foreign law firms.

Finally, the structured brief is passed directly to local, vetted privacy specialists in the target jurisdictions, such as Swiss, Brazilian, Chinese, or UK counsel. The local expert reviews the pre-processed documentation, validates regulatory compliance, and signs off on the final strategy.

This structured workflow ensures that human legal judgment is applied where it matters most—validating nuance, assessing risk appetite, and managing regulatory relationships. At the same time, secure AI handles data parsing, formatting, and initial analysis at a fraction of the traditional cost and time.

Practical risk-solution framework for multi-jurisdictional data transfers

Conclusion: From compliance bottleneck to operational efficiency

Aligning cross-border data transfers with the GDPR and the shifting requirements of local privacy laws is a recurring operational challenge that cannot be solved with isolated legal opinions. As the regulatory landscapes in the UK, Switzerland, Brazil, China, and the US continue to diverge, organizations must move away from ad-hoc drafting and manual tracking.

The key to long-term compliance is a centralized, digital ecosystem where cross-border cases are managed systematically. By integrating secure AI pre-processing—which respects data minimization by design—with structured workflows, transparent cost scoping, and direct access to a vetted network of local legal experts, organizations can turn a complex compliance hurdle into a highly efficient, repeatable business process.

This approach not only protects the business from costly regulatory penalties and operational delays but also gives the legal department the tools to support global growth safely and confidently.

Need international legal help? Get in touch with us via Anywhere.legal.