Set up international transfer safeguards

Set Up International Transfer Safeguards

When personal data leaves its region of origin, GDPR and CPRA require safeguards to ensure it remains protected to the same standard abroad. Transfers must follow approved legal mechanisms, with technical and contractual protections in place.

Choosing a Legal Mechanism

Select an approved basis for transfers outside the EU or California.

• Use Standard Contractual Clauses (SCCs) for EU–non-EU transfers.

• Apply Binding Corporate Rules (BCRs) for intra-company data flows.

• For the U.S., rely on frameworks like the EU–U.S. Data Privacy Framework where applicable.

Technical Safeguards

Prevent unauthorized access during transfer and storage abroad.

• Encrypt data before transfer and use TLS for transmission.

• Apply pseudonymization so identifiers are separate from raw data.

• Keep encryption keys under EU or local control, not in the destination country.

Vendor and Partner Controls

Ensure third parties receiving data meet the same standards.

• Sign contracts including SCCs or equivalent clauses.

• Assess the recipient’s local laws and practices for risks.

• Audit vendors to confirm compliance and security posture.

Example: EU to U.S. Transfer with SCCs

A European SaaS company sending analytics data to a U.S. cloud provider:

• SCCs are signed and attached to the vendor contract.

• All transfers use TLS 1.3 with AES-256 encryption.

• Data is pseudonymized before transfer; user IDs are mapped locally.

• The company reviews U.S. surveillance laws and documents the risk assessment.

Implementing Safeguards in Practice

PostgreSQL with client-side encryption:

-- Encrypt sensitive fields before transfer
UPDATE customers
SET email_encrypted = pgp_sym_encrypt(email, current_setting('app.encryption_key'));

S3 with region restrictions:

{
  "Rules": [
    {
      "ID": "Deny-NonEU-Access",
      "Effect": "Deny",
      "Principal": "*",
      "Action": "s3:*",
      "Resource": "arn:aws:s3:::mybucket/*",
      "Condition": {
        "StringNotEquals": { "aws:RequestedRegion": "eu-west-1" }
      }
    }
  ]
}

TLS enforced transfer:

# Example curl with enforced TLS 1.3
curl --tlsv1.3 https://api.vendor.com/data \
  --cert client.crt --key client.key

Conclusion

By combining legal contracts, encryption, and strict vendor oversight, teams can confidently transfer data across borders while meeting GDPR and CPRA obligations.