Cross-Border Data Transfer

Sending data abroad includes more than copying files. Letting a support team in another country view records on screen can also count as a transfer. Laws worry that protection weakens once data leaves the home jurisdiction. Regimes handle this in different ways. Some allow transfers to countries on an approved list, as with an adequacy decision. Others require contract clauses, binding corporate rules, certification or the person's explicit consent. A few require a copy to stay at home or restrict transfers for certain sectors. Since 2020, European firms have also had to assess whether the destination's government could access the data in ways that undermine the protection. Cloud hosting, group-wide HR systems and outsourced call centres are the usual cases. Mapping who can see what, and from where, is usually the first step in judging whether a transfer is lawful.

A manufacturer moves its customer support to a vendor with staff on another continent. Before go-live, its privacy team maps which data the agents will see, confirms the vendor signed approved contract clauses, assesses the local laws on government access, and records the decision in its transfer register.