SOC 2 P6.6: Privacy - Cross-Border Data Transfers

Map every cross-border personal data transfer. Think broadly: cloud providers hosted in other countries, international offices or subsidiaries, vendors and partners in other jurisdictions, remote employees accessing data from abroad, and backup or disaster recovery sites in other regions. If personal data touches another country, it needs to be on the map. Determine the legal requirements for each transfer. Under GDPR, transfers outside the EEA require a valid transfer mechanism. Other jurisdictions have their own rules. Assess each transfer and document the legal basis. Put the right transfer mechanisms in place. For GDPR-regulated transfers, your options include adequacy decisions (for countries the European Commission has approved), Standard Contractual Clauses (SCCs) for transfers to non-adequate countries, Binding Corporate Rules for intra-group transfers, and derogations for specific situations like explicit consent or contractual necessity. Execute and file the appropriate documentation for each. Run transfer impact assessments for any transfer relying on SCCs. Evaluate whether the destination country's legal framework actually protects the data adequately. If you identify risks, layer on supplementary measures like encryption, pseudonymisation, or additional contractual restrictions. Update your privacy notice to disclose cross-border transfers. Tell data subjects which countries their data may go to, why, and what safeguards protect it. Keep this clear and specific rather than burying it in legal boilerplate. Stay on top of the legal landscape. New adequacy decisions, court rulings that invalidate transfer mechanisms, changes in destination country surveillance laws - any of these can affect your compliance overnight. Assign someone to monitor this and update your transfer mechanisms proactively.