Cross-Border Transfer
The transfer of personal data from one country to another, subject to restrictions under data protection laws.
Full Definition
A cross-border transfer occurs when personal data is transferred to, stored in, or accessed from a country outside the jurisdiction where it was originally collected. Most data protection regulations impose restrictions on such transfers to ensure data subjects' rights remain protected. Under GDPR, transfers outside the EEA require an adequacy decision, Standard Contractual Clauses, Binding Corporate Rules, or another valid mechanism. Under India's DPDP Act, the central government will notify countries to which transfers are permitted. Organisations must map all cross-border data flows to ensure compliance.
How each law treats it
Transfers outside the EEA require adequacy, SCCs, BCRs, derogations or an approved certification. The 2021 modular SCCs replaced the 2010 clauses and must be used for new contracts.
Transfers permitted to adequate jurisdictions (Art. 22) or under Art. 23 safeguards — approved contractual clauses, BCRs, explicit consent, contract performance, public interest or legal claims.
Requires a 'comparable standard of protection' via PDPC model clauses, BCRs, APEC CBPR / PRP certification, or an exception (consent, contractual necessity).
Transfers permitted by default; the Central Government may restrict transfers to specified countries by negative notification.
In practice
- Maintain a transfer register with recipient country, legal mechanism, documentation link, review date and risk tier.
- Pair every SCC-based transfer with a Transfer Impact Assessment (TIA) documenting the recipient-country surveillance landscape and the compensating controls.
- Health data in the UAE is subject to Federal Law No. 2 of 2019 localisation requirements regardless of PDPL safeguards — carve those flows out separately.
Common pitfalls
- Relying on the pre-2021 SCCs for new contracts — the Commission's transition period expired 27 December 2022.
- Treating cloud provider adequacy claims as sufficient for GDPR transfers — the controller still owes the TIA.
- Ignoring onward transfers — your processor's sub-processor in a third country is still your transfer.
Frequently asked questions
Is an EU-US transfer still risky after the Data Privacy Framework?+
The EU-US DPF (adopted 10 July 2023) restored adequacy for US recipients certified under it. For non-certified recipients, you still need SCCs plus a TIA. The next Schrems case may yet unsettle the DPF.
What's a Transfer Impact Assessment (TIA)?+
A documented analysis of whether the SCCs plus any supplementary measures provide 'essentially equivalent' protection in the destination country. Required by the EDPB post-Schrems II for most SCC-based transfers.
Can I rely on consent for one-off transfers?+
Yes, under GDPR Article 49(1)(a) — explicit consent after being informed of the risks. Not a scalable mechanism (consent can be withdrawn) but valid for occasional transfers.
Related terms
Standard Contractual Clauses
Pre-approved contract clauses issued by the European Commission for lawfully transferring personal data outside the EEA.
Data Fiduciary
The Indian equivalent of a Data Controller under the DPDP Act — an entity that determines the purposes and means of processing personal data.
Data Processor
An entity that processes personal data on behalf of and under the instructions of a Data Controller.
Relevant regulations
Automate your privacy program
TruePrivacy handles DSRs, consent management, data mapping, and breach response — all in one platform.
Free 14-day trial · No credit card required · Setup in minutes