Tools Hub/Transfer Matrix

Cross-Border Data Transfer Matrix

21 transfer mechanisms side by side. Filter by origin jurisdiction to compare applicable mechanisms, triggers and lead times, with rule-based pointers.

Filter origin jurisdictions

Annual volume (records)Sensitive personal infoIntra-group transfer

Rule-based pointers

▸APPI: China is not whitelisted — equivalent-protection contract + user consent required.
▸Sensitive personal info (health/biometric) extends lead-time by 30-50% across all regimes.

European Union

EU adequacy decision (GDPR Art. 45)

Low cost

Scope: Once the European Commission decides that a third country, a territory or sector within it, or an international organisation ensures an adequate level of protection, transfers to that destination need no further Art. 46 safeguard and are treated like intra-EU transmissions. As listed on the Commission site on 12 Sep 2026, the covered destinations are Andorra, Argentina, Brazil, Canada (commercial organisations), the Faroe Islands, Guernsey, Israel, the Isle of Man, Japan, Jersey, New Zealand, the Republic of Korea, Switzerland, the United Kingdom (both the GDPR and LED decisions renewed on 19 Dec 2025), the United States (only organisations participating in the EU-US Data Privacy Framework), Uruguay and the European Patent Organisation. Mainland China is not on the list, so a Chinese company cannot itself rely on adequacy; the practical value is in choosing where to place a group entity (a Japanese, Korean or UK subsidiary, for instance).
Triggers: No volume threshold. Adequacy applies whenever the importer sits in a listed country, territory or sector and the transfer falls within the scope of that decision. Two partial decisions need care: Canada covers only private-sector commercial activity subject to PIPEDA; Japan covers only personal information handling business operators (PIHBOs) under the APPI and carries Supplementary Rules. The US decision covers only recipients that are actively self-certified to the Data Privacy Framework for the relevant data category.
Lead time: Estimate: 1-3 working days - this is a verification and documentation exercise, not an approval process.
Binding force: No additional contractual obligation on exporter or importer; data subject rights rest on the destination’s own law and the safeguards the decision relies on.
Validity: Adequacy is open-ended but not permanent: the Commission must review decisions periodically and report to the Parliament and Council, and may suspend, amend or repeal them. Safe Harbor (2015) and Privacy Shield (2020) were both annulled by the Court, so any architecture relying on adequacy must keep an SCC fallback ready.

Official source ↗Reviewed 2026-09-12

European Union

EU Standard Contractual Clauses (Decision 2021/914, four modules)

Medium cost

Scope: The clauses adopted by Commission Implementing Decision (EU) 2021/914 are the most-used "appropriate safeguard" under GDPR Art. 46(2)(c) and need no case-by-case authorisation. They are modular and you pick exactly one: Module One controller-to-controller; Module Two controller-to-processor; Module Three processor-to-processor; Module Four processor-to-controller. The structure is general clauses plus the chosen module plus annexes (Annex I.A parties / I.B description of the transfer / I.C competent supervisory authority, Annex II technical and organisational measures, Annex III sub-processors). Clause 7, the optional docking clause, lets further entities accede later as exporter or importer, which suits group-wide and supply-chain roll-outs.
Triggers: No volume threshold. Whenever personal data goes to a third-country importer with no adequacy decision and no Art. 49 derogation, SCCs are the default. Three points are routinely got wrong: (1) Clause 14 requires a documented assessment of the destination’s laws and practices (a TIA) before the transfer; (2) the pre-2021 SCCs were repealed with effect from 27 Sep 2021 and the transition for contracts concluded on them ended on 27 Dec 2022, so legacy templates are no longer a valid safeguard; (3) where the importer is itself directly subject to the GDPR under Art. 3(2), this set of clauses was not designed for that scenario and the Commission has signalled separate clauses - as of 12 Sep 2026 this research pass found no adopted decision covering it, so treat that case on specific legal advice.
Lead time: Estimate: 2-4 weeks for a single vendor including the TIA; 6-12 weeks for a group-wide roll-out plus supply chain. Expect longer where the importer resists the Clause 14 disclosure duties or the audit rights.
Binding force: Contractually binding on both parties and conferring third-party beneficiary rights on data subjects (Clause 3), enforceable directly against exporter or importer. The text is mandatory and cannot be modified; it may only be embedded in a wider commercial contract or supplemented with stronger safeguards that do not contradict it.
Validity: No fixed expiry - the clauses run with the contract. But Clause 14(e)-(f) imposes a live duty: the importer must promptly notify the exporter if it has reason to believe it is subject to laws or practices out of line with Clause 14(a) (including on receiving a disclosure request); the exporter must then identify remedial measures, suspend the transfer if no adequate safeguards can be ensured, and may terminate.

Official source ↗Reviewed 2026-09-12

European Union

EU transfer impact assessment (SCC Clause 14 / EDPB six-step method)

Medium cost

Scope: A TIA is not a standalone transfer route but a precondition and continuing duty when using Art. 46 tools such as SCCs or BCRs. Clause 14(a) requires both parties to warrant they have no reason to believe the destination’s laws and practices applicable to the importer prevent it from performing the clauses. Clause 14(b) lists the elements to weigh: the specific circumstances of the transfer (length of the processing chain, number of actors, transmission channels, intended onward transfers, type of recipient, purpose, categories and format of data, economic sector, storage location); the laws and practices of the destination - in particular any requirement to disclose to or permit access by public authorities, and the applicable limitations and safeguards; and any contractual, technical or organisational safeguards added on top. Clause 14(c) requires the importer to use best efforts to supply the information; Clause 14(d) requires the assessment to be documented and made available to the supervisory authority on request. EDPB Recommendations 01/2020 set out the six-step method used as the review benchmark.
Triggers: No volume threshold. Any transfer to a third country relying on an Art. 46 tool (SCCs, BCRs, an approved code of conduct or certification mechanism) requires a documented, retained TIA; transfers under an Art. 45 adequacy decision do not. For Chinese companies going abroad the predictable pressure point is the reverse direction: where a Chinese parent or a China-based affiliate is the importer, EU customers and their counsel will probe how the National Intelligence Law, the Counter-Espionage Law and Art. 36 of the Data Security Law (no provision of domestic data to foreign judicial or law-enforcement authorities without approval of the competent authority) apply to the specific transfer, and what transparency and redress exist. Prepare the TIA proactively rather than waiting to be asked.
Lead time: Estimate: 1-2 weeks for a single low-risk destination with established precedent; 4-8 weeks where the data is highly sensitive or the destination’s law is contested, which usually needs local outside counsel.
Binding force: The TIA creates no third-party rights itself, but its conclusion determines whether the SCCs hold: continuing a transfer after concluding that protection cannot be ensured leaves the transfer without a valid basis and exposed to the Art. 83(5)(c) tier (up to EUR 20 million or 4% of total worldwide annual turnover of the preceding financial year, whichever is higher).
Validity: No fixed expiry but a continuing duty: Clause 14(e) requires the importer to notify whenever circumstances change, and Clause 14(f) requires the exporter to identify remedial measures and suspend the transfer if necessary. In practice review at least every 12 months and on any legislative change in the destination.

Official source ↗Reviewed 2026-09-12

European Union

EU Binding Corporate Rules (GDPR Art. 47)

Very high cost

Scope: A one-off approval instrument for transfers inside a group of undertakings or a group of enterprises engaged in a joint economic activity. Once approved by the competent supervisory authority through the Art. 63 consistency mechanism, intra-group transfers to third countries need no per-transfer SCCs. Art. 47(1) requires BCRs to be legally binding on and enforced by every member concerned including employees, to expressly confer enforceable rights on data subjects, and to meet the Art. 47(2) content list. Art. 47(2) requires at minimum: the group structure and contact details of each member; the transfers covered (data categories, type and purposes of processing, types of data subject, third countries involved); their legally binding nature internally and externally; application of the data protection principles (purpose limitation, minimisation, limited storage, data quality, protection by design and by default, legal basis, special categories, security measures, and requirements for onward transfers to bodies not bound by the BCRs); data subject rights and how to exercise them, including the right not to be subject to solely automated decisions, to lodge a complaint with the supervisory authority and before the courts, and to obtain redress and compensation; acceptance by the EU-established controller or processor of liability for breaches by non-EU members; how BCR information is given to data subjects in addition to Arts. 13-14; the tasks of the data protection officer or other compliance monitor; complaint procedures; compliance verification mechanisms including data protection audits and corrective action; mechanisms for reporting and recording changes; cooperation mechanisms with the supervisory authority; a mechanism for reporting to the supervisory authority any third-country legal requirement likely to have a substantial adverse effect on the BCR guarantees; and, under Art. 47(2)(n), appropriate data protection training for personnel having permanent or regular access to personal data.
Triggers: No volume threshold but a structural one: BCRs cover only transfers inside one group of undertakings or a group engaged in a joint economic activity. Transfers to external customers, suppliers or channel partners cannot use BCRs and still need SCCs. There are controller BCRs (BCR-C, for the group acting as controller) and processor BCRs (BCR-P, for intra-group transfers when the group processes on customers’ behalf). The typical fit for a Chinese AI company: an EU entity whose model training, inference operations or support is performed remotely by teams in China or another third country, so that intra-group access is frequent and permanent - at that point BCRs are cheaper than maintaining dozens of SCCs. Note that BCRs do not remove the Art. 46 transfer-assessment duty; Art. 47(2)(m) itself requires conflicting third-country legal requirements to be reported to the supervisory authority.
Lead time: Estimate: 12-24 months from kick-off to formal approval (3-6 months drafting, 9-18 months regulator review plus the consistency mechanism). This is the longest lead time in this matrix and is not a fit for a single project.
Binding force: Legally binding on every member concerned and their employees, and expressly conferring enforceable rights on data subjects. Art. 47(2)(f) makes the EU-established controller or processor liable for breaches by non-EU members, with exemption only on proof that the member was not responsible for the event giving rise to the damage.
Validity: Approval is open-ended with no fixed expiry, but changes in group structure, transfer scope or the third-country legal environment must be reported under Art. 47(2)(k) and (m) and may trigger re-examination. Under Art. 46(5), authorisations granted under Art. 26(2) of Directive 95/46/EC remain valid until amended, replaced or repealed by the supervisory authority.

Official source ↗Reviewed 2026-09-12

European Union

EU derogations for specific situations (GDPR Art. 49)

Low cost

Scope: The fallback where there is neither an Art. 45 adequacy decision nor an Art. 46 safeguard including BCRs. The first subparagraph of Art. 49(1) lists seven grounds: (a) the data subject explicitly consented after being informed of the possible risks arising from the absence of adequacy and safeguards; (b) the transfer is necessary for performance of a contract between the data subject and the controller, or pre-contractual measures at the data subject’s request; (c) it is necessary for the conclusion or performance of a contract concluded in the data subject’s interest between the controller and another person; (d) it is necessary for important reasons of public interest; (e) it is necessary for the establishment, exercise or defence of legal claims; (f) it is necessary to protect the vital interests of the data subject or others where the data subject is physically or legally incapable of giving consent; (g) it is made from a register intended by Union or Member State law to provide information to the public, subject to the consultation conditions and, under Art. 49(2), not involving the entirety of the personal data or entire categories in the register. The second subparagraph adds a very narrow compelling-legitimate-interests route: available only where no Art. 45 or 46 basis and none of the above derogations applies, where the transfer is not repetitive, concerns only a limited number of data subjects, is necessary for compelling legitimate interests of the controller not overridden by the interests or rights and freedoms of the data subject, and the controller has assessed all the circumstances and provided suitable safeguards - and the controller must inform the supervisory authority and, in addition to Arts. 13-14, inform the data subject of the transfer and of the compelling legitimate interests pursued.
Triggers: No volume threshold but an exceptionality threshold: Art. 49 is designed as an exception, not a routine channel, and regulators consistently reject its use for systematic, repetitive, large-scale business transfers. A workable test: if the transfer is a standing part of how the product runs - routing EU users’ prompts to an inference cluster in China every day, say - it cannot rest on Art. 49(1)(a) consent or (b) contractual necessity and must use SCCs or BCRs. Under Art. 49(3), points (a), (b) and (c) and the compelling-legitimate-interests route do not apply to activities carried out by public authorities in the exercise of their public powers; under Art. 49(4) the important public interest in point (d) must be recognised in Union law or the law of the Member State to which the controller is subject.
Lead time: Estimate: 1-2 weeks to design and document the consent flow; add 2-4 weeks for the compelling-legitimate-interests route because the supervisory authority must be informed.
Binding force: It creates no contractual obligation on the importer, which is left bound by no data protection commitment at all - precisely why regulators are hostile to it. Misuse of Art. 49 leaves the transfer without a valid basis and falls in the Art. 83(5)(c) tier (up to EUR 20 million or 4% of total worldwide annual turnover of the preceding financial year, whichever is higher).
Validity: Tied to the specific situation and not a standing basis. Where consent is the ground the data subject may withdraw it at any time, after which continued processing of the transferred data needs another basis or deletion. The second-subparagraph route is expressly limited to non-repetitive transfers and cannot be rolled forward as a standing arrangement.

Official source ↗Reviewed 2026-09-12

European Union

EU-US Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795)

Low cost

Scope: A sectoral adequacy decision for the United States: Commission Implementing Decision (EU) 2023/1795, adopted on 10 Jul 2023 and published in the Official Journal on 20 Sep 2023, finds that US commercial organisations participating in the EU-US Data Privacy Framework ensure an adequate level of protection. When retrieved on 12 Sep 2026, EUR-Lex showed the decision as in force and the Commission adequacy list still names the United States (participating commercial organisations only). On the litigation front, the General Court gave judgment in Case T-553/23 (Latombe v Commission) on 3 Sep 2025, point 1 of the operative part being to dismiss the action, so the decision stands at first instance; that judgment is under appeal, however - Case C-703/25 P was lodged before the Court of Justice on 31 Oct 2025 (notice at OJ C, C/2025/6610, 22.12.2025) and no final judgment was found as at 12 Sep 2026, so T-553/23 must not be read as final judicial confirmation of the DPF. What this means for a Chinese company: only US organisations can self-certify to the DPF, so a Chinese entity cannot join. Its value is that where EU data lands with a US cloud, SaaS or analytics provider, the SCCs and TIA with that US importer become unnecessary.
Triggers: No volume threshold. It can be relied on only where the US importer is Active on the Data Privacy Framework list and the data category in question falls within its self-certification. Three frequent errors: (1) HR data requires separate certification and is otherwise not covered; (2) a listing can go Inactive or be removed, in which case the US entity still owes continuing obligations for data already received but new transfers lose their basis; (3) the UK and Switzerland each have their own extension (for the UK, the UK-US data bridge / UK Extension), and the EU decision does not automatically cover transfers out of the UK or Switzerland.
Lead time: Estimate: 1-3 working days for the listing check and the contract amendment.
Binding force: No extra contractual duty on the EU exporter; the US importer is bound by the commitments in its self-certification to the Department of Commerce, enforced by the FTC or the Department of Transportation, with independent dispute resolution and, in defined circumstances, binding arbitration. Data subjects can also use the redress mechanism the decision establishes for national-security access.
Validity: The decision is open-ended but subject to periodic review; the Commission published the first review report on 9 Oct 2024. Two risks run in parallel. Judicial: its two predecessors, Safe Harbor and Privacy Shield, were annulled by the Court of Justice in 2015 and 2020, and the first-instance judgment upholding the current decision (T-553/23) is itself before the Court of Justice on appeal in Case C-703/25 P, with no final outcome yet. Political and institutional: how the US redress mechanism actually operates. So any architecture relying on the DPF should keep SCCs ready to switch on. At company level, validity depends on the importer completing its annual re-certification on time.

Official source ↗Reviewed 2026-09-12

China (Mainland)

Security assessment filing for outbound data transfers (CAC Order No. 11 as modified by Order No. 16)

Very high cost

Scope: The highest and most substantive of China’s three statutory outbound routes: the data handler files through the provincial cyberspace administration to the national CAC, which convenes State Council departments, provincial CAC offices and specialist institutions to assess. The assessment focus under Art. 8 of Order No. 11 covers the legality, legitimacy and necessity of the purpose, scope and means of the transfer; the effect of the destination country’s data security policies, laws and cybersecurity environment on the data, and whether the overseas recipient’s protection level meets Chinese laws, administrative regulations and mandatory national standards; the volume, scope, categories and sensitivity of the data and the associated risks; whether data security and personal information rights can be effectively guaranteed; whether the intended legal documents adequately allocate data security responsibilities; and compliance with Chinese law generally.
Triggers: Under Art. 7 of Order No. 16 a security assessment must be filed where: (1) a critical information infrastructure operator (CIIO) provides personal information or important data abroad; or (2) a non-CIIO data handler provides important data abroad, or has cumulatively provided abroad, since 1 January of the current year, the personal information of more than 1,000,000 individuals (excluding sensitive personal information) or the sensitive personal information of more than 10,000 individuals. Where Arts. 3, 4, 5 or 6 of Order No. 16 apply, those provisions govern first (exemptions and the free-trade-zone negative list). Two points must be got right: (1) the count runs "cumulatively from 1 January of the current year", replacing the "from 1 January of the previous year" wording in Art. 4 of Order No. 11; (2) important data is identified under Art. 2 of Order No. 16 and Art. 37 of the Network Data Security Management Regulations - if no department or region has notified or publicly published the data as important data, the handler need not file it as such.
Lead time: Estimate: the statutory steps total roughly 57 working days (5 for the provincial completeness check, 7 for the national acceptance decision, 45 for the assessment, extendable). Adding the self-assessment, negotiation of the legal document and package preparation, 4-8 months from kick-off to outcome is typical in practice, and a returned package lengthens it materially.
Binding force: An administrative approval: transferring without a passed assessment is an unlawful outbound transfer, pursued under the Cybersecurity Law, the Data Security Law and PIPL, with criminal liability where a crime is constituted. Where the national CAC finds an approved transfer no longer meets the requirements in practice it may order the transfer terminated in writing, with a fresh filing required after rectification. Knowingly filing false materials is treated as a failed assessment and pursued accordingly.
Validity: Under Art. 9 of Order No. 16 an approved assessment is valid for three years from the date the result is issued (replacing the two years originally set in Art. 14 of Order No. 11). To continue transfers past expiry, where no re-filing trigger has occurred, the handler may apply through the provincial CAC to the national CAC within 60 working days before expiry for a three-year extension. The conditions for that extension are set out in the third edition of the security assessment filing guide, as quoted in the CAC Q&A of July 2026, and all six must be met: the purpose and scope of the transfer are unchanged; the handler and the overseas recipient are unchanged; for personal information, the number of individuals over the next three years grows by no more than 20% of the volume the original result permitted over the past three years; for important data, the volume over the next three years grows by no more than 20% on the same basis; the legal document with the overseas recipient complies with Art. 9 of Order No. 11; and over the past three years the transfers were conducted strictly in line with the assessment result notice with no major data security incident. Within the validity period the changes listed in Art. 14 of Order No. 11 - changes to the purpose, means, scope or categories of the transfer or the recipient’s use and means, extension of the overseas retention period, changes in the destination’s policies, laws or cybersecurity environment or force majeure, changes of actual control, or amendments to the legal document that affect security - require a fresh filing.

Official source ↗Reviewed 2026-09-12

China (Mainland)

Filing of the China standard contract for outbound personal information transfers (CAC Order No. 13 as modified by Order No. 16)

Medium cost

Scope: The workhorse for the middle volume band: the personal information handler concludes the standard contract in the annex to CAC Order No. 13 with the overseas recipient and files it with the provincial cyberspace administration. The design combines free contracting with a filing regime - the transfer may begin once the contract takes effect, and the filing is made afterwards within 10 working days, so it is not a prior approval. The text must follow the annex strictly; additional terms may be agreed but must not conflict with the standard contract.
Triggers: Under Art. 8 of Order No. 16: a non-CIIO data handler that has cumulatively provided abroad, since 1 January of the current year, the personal information of 100,000 or more but fewer than 1,000,000 individuals (excluding sensitive personal information), or the sensitive personal information of fewer than 10,000 individuals, must either conclude the standard contract with the overseas recipient or obtain personal information protection certification. Where Arts. 3, 4, 5 or 6 of Order No. 16 apply, those provisions govern. Art. 4 of Order No. 13 originally set four cumulative conditions (non-CIIO; processing the personal information of fewer than 1,000,000 individuals; fewer than 100,000 individuals’ personal information transferred abroad cumulatively since 1 January of the previous year; fewer than 10,000 individuals’ sensitive personal information on the same count); to the extent these conflict with Order No. 16, Art. 13 of Order No. 16 makes Order No. 16 prevail. Splitting volumes to avoid the security assessment is expressly prohibited by the final paragraph of Art. 4 of Order No. 13. Terminology note: the alternative option in Art. 8 of Order No. 16, "obtain personal information protection certification", has since 1 Jan 2026 been governed by its own instrument, the Measures for Personal Information Outbound Transfer Certification (CAC and SAMR Order No. 20), and the official term is now "personal information outbound transfer certification" - see the corresponding entry in this matrix.
Lead time: Estimate: 3-6 weeks for the impact assessment and contract negotiation; the filing itself is due within 10 working days of the contract taking effect. Provinces differ in formal requirements and response pace, and in practice feedback or a request to supplement typically arrives 2-8 weeks after submission.
Binding force: The standard contract text is mandatory, binds both parties and confers rights individuals can assert (the template includes third-party beneficiary provisions). Splitting volumes to avoid the security assessment is prohibited, with liability under PIPL and related laws.
Validity: The standard contract has no statutory expiry and runs with the contract, but the changes listed in Art. 8 of Order No. 13 require a fresh assessment, a supplemented or re-executed contract and a fresh filing. Filing is an after-the-fact control: completing it is not a regulatory confirmation of compliance, and the cyberspace authorities retain ongoing supervisory and rectification powers.

Official source ↗Reviewed 2026-09-12

China (Mainland)

China personal information outbound transfer certification (CAC and SAMR Order No. 20, in force 1 Jan 2026)

High cost

Scope: The certification route under Art. 38(1)(2) of PIPL, an alternative to standard-contract filing within the same volume band. The governing instrument is now the Measures for Personal Information Outbound Transfer Certification (CAC and SAMR Order No. 20, published 17 Oct 2025, in force from 1 Jan 2026); before that only the general 2022 Implementation Rules applied. Article 3 defines outbound-transfer certification as a conformity assessment in which a professional certification body holding personal information protection certification qualifications attests that the handler’s provision of personal information abroad, and related processing, conforms to the applicable laws, administrative regulations, departmental rules, standards and technical specifications. Article 4 splits responsibility: the national cyberspace authority, with the national data authority and other departments, sets the certification standards and technical specifications, while the market regulation authority, with the cyberspace authority, sets the certification rules and the uniform certificate and mark. The basis standards have changed: under SAMR/CAC Announcement No. 53 of 2025 (dated 12 Dec 2025), from the date of that announcement the certification basis for cross-border processing becomes GB/T 35273 (Personal information security specification) and GB/T 46068 (Security certification requirements for cross-border processing of personal information) - TC260-PG-20222A no longer serves as the cross-border basis, so certification scopes and diligence questionnaires written before the end of 2025 need updating. At implementation level the three-stage model of the Implementation Rules still applies - technical verification, on-site audit and post-certification supervision - as do the two certification marks (with and without cross-border processing; "ABCD" in the mark is the certification body identifier).
Triggers: The volume band matches the standard contract and is restated independently in Art. 5 of Order No. 20: a handler using certification to provide personal information abroad must satisfy both (1) it is not a CIIO; and (2) it has cumulatively provided abroad, since 1 January of the current year, the personal information of 100,000 or more but fewer than 1,000,000 individuals (excluding sensitive personal information), or the sensitive personal information of fewer than 10,000 individuals. Art. 5(2) states that the personal information referred to does not include important data; Art. 5(4) prohibits splitting volumes to divert to certification data that must go through the security assessment. Certification cannot substitute for the assessment once the Art. 7 thresholds of Order No. 16 are met. Two practical points from the CAC Q&A of September 2026: (1) a handler of any size may voluntarily apply to a professional body for certification to demonstrate and improve compliance, but only a handler inside the Art. 5 band may rely on certification as the legal basis for the transfer; (2) a certified handler whose cumulative outbound volume reaches 1,000,000 individuals’ personal information or 10,000 individuals’ sensitive personal information must still file a security assessment, and may attach its certification record for the authorities to take into account. Selection rule of thumb: certification suits groups with many entities, many routes and permanent flows, because one certificate can cover multiple processing activities within its scope; a single counterparty on a single route is better served by the standard contract.
Lead time: Estimate: 3-6 months from engagement to certificate (technical verification and the on-site audit take weeks each, and rectification rounds extend this). Neither Order No. 20 nor the Implementation Rules sets a uniform statutory turnaround; they require the body to define and meet time limits for each stage. The fixed deadlines in Order No. 20 fall on the body and the regulator (a body must file within 10 working days of qualifying, the CAC reviews within 30 working days, certificate information is reported within 5 working days). The real timeline depends on the chosen body’s implementation rules and the applicant’s responsiveness.
Binding force: Certification is a voluntary conformity assessment, but once relied on as a transfer basis it carries continuing obligations: failing post-certification supervision, or transferring outside the certified scope, leads to suspension or withdrawal, at which point the transfer loses its legal basis. Art. 11 additionally requires the professional body, on finding in the course of certification that an outbound transfer breaches law, administrative regulation or national rules, to report promptly to the CAC and other authorities - the body carries a reporting duty, so certification should not be treated as a purely commercial service. Use of the certificate and mark is restricted and must not mislead the public in advertising or other promotion.
Validity: The certificate is valid for three years (Art. 8) and is maintained through the body’s post-certification supervision; renewal must be applied for six months before expiry. Under Art. 10, where the body finds that the certified handler’s outbound activity does not match the certification scope, or that it otherwise no longer meets the requirements, it must suspend and ultimately withdraw the certificate; where the CAC or another authority finds this in the course of supervision, the body must cooperate in suspending and withdrawing it. Both are published on the national certification and accreditation public service platform. Certification is therefore not a one-off credential but a status tied continuously to whether the actual transfers still sit inside the certified scope.

Official source ↗Reviewed 2026-09-12

China (Mainland)

China outbound transfer exemptions and volume thresholds (Arts. 3-5, CAC Order No. 16)

Low cost

Scope: The Provisions on Promoting and Regulating Cross-Border Data Flows, in force from 22 Mar 2024, opened a triple exemption for most outbound scenarios - exempt from the security assessment filing, from the standard contract and from certification. Article 3: data collected and generated in international trade, cross-border transport, academic cooperation, transnational manufacturing and marketing, where it contains no personal information and no important data. Article 4: personal information collected and generated abroad, brought into China for processing and then provided abroad again, where no domestic personal information or important data was introduced during processing. Article 5 (four grounds, and the personal information referred to does not include important data): (1) transfers genuinely necessary to conclude or perform a contract to which the individual is a party - cross-border shopping, delivery, remittance, payment, account opening, air ticket and hotel booking, visa processing, examination services and the like; (2) transfers of employee personal information genuinely necessary for cross-border human resources management under lawfully formulated labour rules and a lawfully concluded collective contract; (3) transfers genuinely necessary in an emergency to protect the life, health or property safety of a natural person; (4) a non-CIIO data handler that has cumulatively provided abroad, since 1 January of the current year, the personal information of fewer than 100,000 individuals (excluding sensitive personal information). Article 35 of the Network Data Security Management Regulations adds further permitted grounds, including transfers genuinely necessary to perform statutory duties or obligations, and other conditions prescribed by law, administrative regulation or the national cyberspace authority.
Triggers: The volume ladder, which must be read together with the assessment and standard-contract thresholds: for a non-CIIO, personal information (excluding sensitive personal information) provided abroad cumulatively since 1 January of the current year for fewer than 100,000 individuals is fully exempt; 100,000 or more but fewer than 1,000,000 requires the standard contract or certification; 1,000,000 or more requires the security assessment. Sensitive personal information is counted separately: fewer than 10,000 individuals requires the standard contract or certification; 10,000 or more requires the security assessment. CIIOs need care here: on its wording the 100,000-person exemption in Art. 5(4) is given only to "data handlers other than critical information infrastructure operators", so a CIIO cannot invoke it; at the same time the closing paragraph of Art. 7 of Order No. 16 provides that "where Arts. 3, 4, 5 or 6 of these Provisions apply, those provisions govern", and Arts. 3, 4, 5(1)-(3) and 6 do not on their face exclude CIIOs. But a CIIO providing personal information or important data abroad is the express filing trigger in Art. 7(1) and supervision is strict in practice, so a CIIO intending to rely on any of those exemptions should clear it with the competent cyberspace authority rather than decide alone. Three traps: (1) the count runs cumulatively from 1 January of the current year and resets each year - it is not a rolling 12 months; (2) the exemption removes the transfer mechanism only, not the PIPL duties - Art. 10 of Order No. 16 expressly requires notice, separate consent and a personal information protection impact assessment, and Art. 11 still requires data security duties and reporting of actual or potential data security incidents to the provincial or higher cyberspace authority; (3) sensitive personal information is outside Art. 5(4), whose text expressly excludes it.
Lead time: Estimate: 2-4 weeks to build the ledger, fix the counting convention and produce the exemption memorandum; there is no approval step.
Binding force: The exemption does not displace other duties: Art. 10 of Order No. 16 (notice, separate consent, impact assessment) and Art. 11 (data security duties, remediation and reporting incidents to the provincial or higher cyberspace authority) continue to apply, and Art. 12 has local cyberspace authorities supervising before, during and after the transfer, ordering rectification where significant risk or an incident is found and pursuing liability where a handler refuses to rectify or causes serious consequences.
Validity: The exemption lasts as long as the facts hold and has no expiry, but the volume thresholds are a live, annually reset test, and growth in traffic or a new sensitive data category can end the exemption mid-year. Review the ledger monthly, reset the count each January and reissue the exemption memorandum annually.

Official source ↗Reviewed 2026-09-12

China (Mainland)

Free trade zone data export negative list (Art. 6, CAC Order No. 16)

Low cost

Scope: Article 6 of Order No. 16 empowers each free trade zone, within the national data classification and grading framework, to draw up its own list of data that must go through the security assessment, the standard contract or certification - the negative list - subject to approval by the provincial cybersecurity and informatisation commission and filing with the national cyberspace authority and the national data authority. A data handler inside the zone providing data outside that list abroad is exempt from the security assessment filing, the standard contract and certification. The logic is the inverse of the national rules: instead of regulating above a threshold, only listed data is regulated and everything else flows, which makes it the most permissive route for companies located in a zone.
Triggers: The route applies only where both the handler and the data fall within a free trade zone that has published an approved and filed negative list. Volume thresholds are set by each zone in its own list, typically layered by industry and data category and sometimes with headcount or volume cut-offs, so there is no nationwide numeric threshold - the current list text must be checked zone by zone and catalogue by catalogue. What was verified: the mechanism and approval chain established by Art. 6 of Order No. 16 (approval by the provincial cybersecurity and informatisation commission, then filing with the national cyberspace authority and the national data authority); and that zones do publish formal negative lists, verified on one example - the notice of the Beijing cyberspace administration and two other departments issuing the Beijing FTZ data export negative list administrative measures (trial) and the 2024 negative list (Jing Wang Ban Fa [2024] No. 16, dated 26 Aug 2024, published 30 Aug 2024, marked in force on the municipal portal), with the measures and the list released as annexes. What was not verified: the individual entries, industry coverage or thresholds of any list. Versions differ by zone and are revised continuously (the CAC policy column separately lists updates for Shanghai on 29 Apr 2026, Beijing on 11 May 2026 and Guangdong on 18 May 2026, and Tianjin, Zhejiang, Jiangsu, Chongqing, Guangxi and Hainan have their own), so the Beijing 2024 list has very likely been superseded. Confidence is therefore medium: always go back to the latest list published by the target zone’s administrative committee or the local cyberspace authority.
Lead time: Estimate: 2-4 weeks for the comparison and documentation. This pass did not verify whether individual zones impose a local registration step or its timing; where the target zone does, add its published timeline.
Binding force: The route waives only the three transfer mechanisms; it does not waive the Art. 10 and Art. 11 duties of Order No. 16 and does not change the special rules for important data or CIIOs. The handler bears responsibility for the off-list determination, and a wrong call is treated as an unlawful outbound transfer.
Validity: The exemption tracks the version of the negative list and must be re-checked after any revision. This pass did not verify the validity period or revision cycle of any specific zone’s list; judging by publication cadence (several zones issued new versions in 2025 and 2026 after their 2024 lists), review at least annually.

Official source ↗Reviewed 2026-09-12

United States (Federal)

US DOJ bulk sensitive personal data rule (28 CFR Part 202): prohibited and restricted transactions

Very high cost

Scope: This is transfer control running the other way: it gives Chinese companies no outbound route but restricts US persons from making Americans’ bulk sensitive personal data and government-related data available to countries of concern or covered persons. The list of countries of concern sits at 28 CFR 202.601(a): China, Cuba, Iran, North Korea, Russia and Venezuela, with China defined by 202.208 to include the Hong Kong and Macau Special Administrative Regions (202.209 states only the criteria for the determination, not the list). The rule splits transactions in two. Prohibited: 202.301 bars a US person from knowingly engaging, on or after the effective date, in a covered data transaction involving data brokerage with a country of concern or covered person; 202.302 extends this to other data-brokerage transactions involving potential onward transfer; 202.303 prohibits transactions involving bulk human omic data and human biospecimens from which it can be derived; 202.304 prohibits evasions, attempts, causing violations and conspiracies; 202.305 prohibits knowingly directing prohibited or restricted transactions. Restricted: 202.401(a) provides that, except as otherwise authorised under subparts E or H or another provision of the part, no US person may knowingly engage, on or after the effective date, in a covered data transaction involving a vendor agreement, employment agreement or investment agreement with a country of concern or covered person unless it complies with the security requirements required by subpart D (202.248 incorporates by reference the CISA Security Requirements for Restricted Transactions, E.O. 14117 Implementation, January 2025) and all other applicable requirements. 202.401(b) excludes from subpart D transactions involving bulk human omic data or biospecimens that are prohibited under 202.303.
Triggers: The bulk thresholds are in 28 CFR 202.205: any amount of sensitive personal data meeting or exceeding the following at any point in the preceding 12 months, whether in a single covered data transaction or aggregated across transactions involving the same US person and the same foreign person or covered person - (a) human omic data on more than 1,000 US persons, or, for human genomic data, more than 100 US persons; (b) biometric identifiers on more than 1,000 US persons; (c) precise geolocation data on more than 1,000 US devices; (d) personal health data on more than 10,000 US persons; (e) personal financial data on more than 10,000 US persons; (f) covered personal identifiers on more than 100,000 US persons; (g) combined data, meaning any set containing more than one of the categories in (a) to (f), or any listed identifier linked to categories in (a) to (e), where any individual data type meets the threshold for the lowest number of US persons or devices in that category. The direct consequence for a Chinese AI company: even where it never touches the data, once a US vendor, customer or portfolio company classifies the deal as a restricted transaction, that party’s compliance cost and security requirements are pushed down into your technical and contractual terms - no access from personnel in China, key escrow, data segregation - and may simply cause the US side to decline the deal.
Lead time: Estimate: 2-4 weeks to classify the transaction and the data; 3-6 months to implement the security requirements and stand up the data compliance program for restricted transactions (access control rework, data segregation, logging and audit capability). The timeline for a specific licence is set case by case by DOJ and was not verified in this pass, so assess it per project.
Binding force: A mandatory prohibition enforced under IEEPA, carrying civil and criminal liability. 202.304 separately prohibits evasions, attempts, causing violations and conspiracies, and 202.305 prohibits knowingly directing prohibited or restricted transactions, so routing through a third party or structuring around the rule is equally unlawful. This entry verifies the regulatory text only; penalty amounts and published enforcement actions were not verified.
Validity: The rule took effect on 8 Apr 2025 (the Federal Register effective-date field for the final rule, which is also the approval date for the incorporation by reference). The data compliance program under 202.1001(a) was due by no later than 6 Oct 2025. The list of countries of concern can be amended, and under 202.601(b) any amendment applies to covered data transactions initiated, pending or completed on or after its effective date - so it reaches in-flight deals immediately. A Federal Register API search on 12 Sep 2026 found one later amendment to 28 CFR Part 202: a correcting amendment (2025-06477) published and effective on 18 Apr 2025 which fixes a single cross-reference and changes no substantive obligation; no other amending rule was found.

Official source ↗Reviewed 2026-09-12

United Kingdom

UK International Data Transfer Agreement (IDTA) and Addendum to the EU SCCs

Medium cost

Scope: The "standard data protection clauses" under the UK GDPR, issued by the ICO in two alternative forms: the International Data Transfer Agreement (IDTA) and the International Data Transfer Addendum to the European Commission standard contractual clauses. The EU SCCs alone are not a valid safeguard for UK restricted transfers, but the Addendum lets you rely on them. The IDTA has four parts: Part 1 Tables (always to be completed), Part 2 Extra Protection Clauses, Part 3 Commercial Clauses and Part 4 Mandatory Clauses. The ICO’s own selection guidance: the Addendum appeals if you operate in both the UK and the EEA and already use the EU SCCs for European flows, or if the recipient already uses the EU SCCs; you may also use the Addendum if you operate only under the UK GDPR. The ICO is equally clear that, alongside signing the clauses, you must complete a transfer risk assessment so that the standard of protection is not materially lower after the transfer.
Triggers: No volume threshold. Any restricted transfer from the UK to a separate organisation abroad that is not covered by UK adequacy regulations and cannot use an exception (a derogation in the legislation) needs an appropriate safeguard, and the IDTA or the Addendum are the two usual ones. Watch the terminology shift: the Data (Use and Access) Act 2025 renamed the transfer risk assessment in the legislation as the "data protection test", while ICO guidance still uses TRA; and the standard is expressed in ICO guidance as the protection for people’s information being "not materially lower" after the transfer. On versions, the ICO guidance (page DC.Date metadata 15 Jan 2026) states verbatim: "We plan to update the IDTA and Addendum in the course of 2026. You should continue to use the current versions." The current templates are IDTA A.1.0 and Addendum B.1.0, laid before Parliament under s119A of the Data Protection Act 2018 on 2 February 2022, and Section 5.4 of the IDTA and Section 18 of the Addendum let the parties opt into automatic updating when the ICO issues a new version.
Lead time: Estimate: 2-4 weeks for a single vendor including the TRA; 1-2 weeks where EU SCCs already exist and only the Addendum needs to be layered on.
Binding force: Contractually binding on exporter and importer and conferring enforceable rights on individuals. EU SCCs alone do not satisfy the UK GDPR and must be layered with the Addendum, which is the single most common omission for Chinese companies serving both UK and EU customers.
Validity: No fixed expiry - the clauses run with the contract. The ICO has announced that it plans to update the IDTA and Addendum in the course of 2026 to reflect the DUAA amendments; if the automatic-update option was not taken, the parties will need to re-execute the new versions. The TRA must be reviewed as circumstances change.

Official source ↗Reviewed 2026-09-12

United Kingdom

UK adequacy regulations (data bridges, including the UK Extension to the DPF)

Low cost

Scope: Adequacy regulations made by the UK government under the UK GDPR, also called data bridges, determining which countries, territories or sectors within a country, or international organisations, provide protection that is "not materially lower" than UK law. They come as full adequacy, covering all restricted transfers to that country or organisation, or partial adequacy, covering only certain organisation types or sectors, data types, regions or conditions - scope must be checked before relying on them. Per ICO guidance (page DC.Date metadata 15 Jan 2026, read on 12 Sep 2026) the current list is: all EEA states (the 27 EU Member States plus Iceland, Norway and Liechtenstein) and EU or EEA institutions, bodies, offices and agencies; the destinations covered by European Commission decisions valid at 31 December 2020 or transitioned into UK law - full: Andorra, Argentina, the Faroe Islands, Gibraltar, Guernsey, the Isle of Man, Israel, Jersey, New Zealand, Switzerland and Uruguay; partial: Canada (only where the information is subject to PIPEDA) and Japan (only private-sector recipients that are personal information handling business operators under the APPI, with Art. 1(2) of that decision listing the recipient categories not covered); and regulations made since 31 December 2020 - full: the Republic of Korea; partial: the United States, covering only personal information transferred under the UK Extension to the EU-US Data Privacy Framework (the UK-US data bridge).
Triggers: No volume threshold. Three points must be got right: (1) the UK adequacy regulations for the US are made independently by the UK government and cover only personal information transferred under the UK Extension to the DPF (the UK-US data bridge); they are a separate instrument from the EU’s Decision (EU) 2023/1795 - so a change on the EU side of the DPF, including the outcome of the appeal in C-703/25 P, does not automatically end the UK route, or vice versa, and both must be tracked separately; (2) transfers under adequacy regulations need no transfer risk assessment and no appropriate safeguard, though the ICO is explicit that you should still make reasonable and proportionate checks that the recipient complies with its local data protection obligations; (3) the UK list differs from the EU list - Gibraltar is on the UK list but not the EU one, and the mutual EU-Brazil adequacy of early 2026 does not appear on the ICO page - so never map one list onto the other when operating across both regimes.
Lead time: Estimate: 1-3 working days for verification and documentation.
Binding force: No additional contractual obligation on exporter or importer; protection rests on the destination’s law and the mechanisms the regulations rely on.
Validity: Regulations are open-ended but can be amended or revoked, and the UK government conducts reviews. The recent cadence on the other side is instructive: the two EU decisions for the UK were technically extended on 24 Jun 2025 and renewed on 19 Dec 2025, showing that findings in both directions sit in a periodic review cycle. Relying parties should review at least annually.

Official source ↗Reviewed 2026-09-12

Singapore

Singapore PDPA transfer limitation obligation (s 26 + Part 3 of the 2021 Regulations)

Low cost

Scope: Section 26(1) of the PDPA provides that an organisation must not transfer any personal data to a country or territory outside Singapore except in accordance with requirements prescribed under the Act to ensure that the organisation provides a standard of protection to the transferred data comparable to the protection under the Act. Section 26(2) lets the PDPC, on application, exempt an organisation by written notice from any prescribed requirement in respect of any transfer; section 26(3) provides that such an exemption may be subject to conditions, need not be published in the Gazette and may be revoked at any time; section 26(4) lets the Commission add to, vary or revoke conditions at any time. The detail is in Part 3 of the Personal Data Protection Regulations 2021: regulation 10 requires the transferring organisation, before transferring, to take appropriate steps to ascertain whether and ensure that the recipient is bound by legally enforceable obligations to provide a standard of protection at least comparable to the Act; regulation 11 defines those obligations as arising under any law, a contract meeting regulation 11(2), binding corporate rules meeting regulation 11(3), or any other legally binding instrument; regulation 12 deems a recipient holding a specified certification to be so bound.
Triggers: No volume threshold - any transfer of personal data outside Singapore is caught. Regulation 10(2) deems regulation 10(1) satisfied in five cases: (a) the individual consents to the transfer to that recipient in that country or territory, subject to regulation 10(3); (b) the individual is deemed to have consented to disclosure to that recipient under section 15(3), (4), (5), (6), (7) or (8) of the Act; (c) the transfer is necessary for the data to be used or disclosed under Part 1 or paragraph 2 of Part 2 of the First Schedule to the Act and the transferring organisation has taken reasonable steps to ensure the recipient will not use or disclose it for any other purpose; (d) the data is data in transit; (e) the data is publicly available in Singapore. Under regulation 10(3) consent does not count where: (a) the individual was not given, before consenting, a reasonable summary in writing of the extent to which the data will be protected to a comparable standard in that country or territory; (b) the organisation required consent as a condition of providing a product or service, unless the transfer is reasonably necessary to provide it; or (c) the organisation obtained or attempted to obtain consent by providing false or misleading information about the transfer or by other deceptive or misleading practices. Regulation 10(4) preserves the right to withdraw consent. The minimum contract requirements in regulation 11(2): the contract must require the recipient to provide a comparable standard of protection and must specify the countries and territories to which the data may be transferred. Binding corporate rules under regulation 11(3) may be used only for recipients related to the transferring organisation, must require every related recipient to provide a comparable standard, and must specify the recipients covered, the countries and territories, and the rights and obligations provided.
Lead time: Estimate: 1-3 weeks for the contract route; 4-8 weeks for intra-group binding corporate rules; the certification route depends on whether the recipient already holds one - a new CBPR/PRP certification typically takes months, and accreditation-body timelines were not verified in this pass.
Binding force: Section 26(1) is a mandatory obligation whose effect is to keep responsibility for the comparable standard with the transferring organisation: even if the recipient breaches, the transferring organisation answers to the PDPC. A written PDPC exemption may be conditional, may be revoked at any time and need not be gazetted.
Validity: No fixed expiry - it runs with the contract or the rules, and the certification route lasts as long as the recipient’s certification. Version note: regulation 12 was amended by S 86/2026 with effect from 2 Mar 2026 to add the Global CBPR System and the Global PRP System alongside the APEC systems, so contracts and diligence questionnaires drafted before March 2026 may not cover them and should be refreshed.

Official source ↗Reviewed 2026-09-12

Japan

Japan APPI restriction on providing personal data to third parties in foreign countries (Art. 28)

Medium cost

Scope: Article 28(1) of the APPI provides that, except in the cases listed in the items of Art. 27(1), a business handling personal information must obtain the individual’s prior consent to provision to a third party in a foreign country (a country or region outside Japan) before providing personal data, and that Art. 27 then does not apply. Two categories are carved out of the restriction: a foreign country prescribed by Rules of the Personal Information Protection Commission as having a personal information protection system recognised to have standards equivalent to Japan’s for protecting individual rights and interests; and a third party that has established a system conforming to standards prescribed by PPC Rules as necessary for continuously taking measures equivalent to those a business handling personal information must take under this Section ("equivalent measures"). Article 28(2) requires that, before seeking consent under Art. 28(1), the business provide the individual with information on the foreign country’s personal information protection system, on the measures the third party takes to protect personal information, and on other matters that serve as a reference, in accordance with PPC Rules. Article 28(3) requires that, where personal data has been provided to a foreign third party that has established the system described in Art. 28(1), the business take the measures necessary to ensure the third party continues to implement the equivalent measures, and provide information about those measures to the individual on request, in accordance with PPC Rules.
Triggers: No volume threshold - any provision of personal data to a third party in a foreign country is caught, and under Japanese law "provision" includes making the data accessible to the foreign third party, while a separate legal entity in the same group is still a third party. There are three alternative routes: (1) the whitelist - where the destination is prescribed by PPC Rules as having a system with standards equivalent to Japan’s, the restriction does not apply. This pass did not verify the current list of whitelisted countries from an official source; check the PPC Rules text before relying on it. (2) The system route - the recipient has established a system conforming to the PPC Rules standards for continuously taking equivalent measures, implemented in practice through contract or intra-group rules; no separate cross-border consent is then needed, but the Art. 28(3) duties to ensure continued implementation and to provide information on request apply. (3) The consent route - obtain the individual’s prior consent to provision to a foreign third party, having first supplied the reference information required by Art. 28(2). The commonest error made by Chinese companies is conflating Arts. 27 and 28: where data is provided under Art. 28(1), Art. 27 does not apply, but the record-keeping duty in Art. 29 still applies subject to its provisos.
Lead time: Estimate: 3-6 weeks for the system route (contract plus the continuing-assurance mechanism); 2-4 weeks for the consent route including drafting the notice and reworking the consent flow.
Binding force: Article 28 is a statutory duty, and breach exposes the business to PPC supervisory measures such as guidance, recommendations and orders. This entry verifies the text of Arts. 28 and 29 only; the specific penalty amounts were not verified.
Validity: No fixed expiry. The Art. 28(3) continuing-assurance duty makes it a live obligation: reassess and take the necessary measures where the recipient’s local legal system changes or its implementation degrades. Version note: this entry rests on the consolidated translation published by the PPC; the APPI is subject to periodic review and amendment activity should be tracked separately - this pass did not verify whether any amendment to Art. 28 took effect in 2025-2026.

Official source ↗Reviewed 2026-09-12

South Korea

Korea PIPA cross-border transfer of personal information (Arts. 28-8 to 28-11)

Medium cost

Scope: Article 28-8(1) of PIPA prohibits a personal information controller from providing personal information overseas (including where it is accessed), entrusting its processing or storing it abroad - collectively "transfer" in this Section - except where one of the following applies: (1) separate consent to the overseas transfer has been obtained from the data subject; (2) a statute, a treaty to which Korea is a party or another international agreement contains special provisions on overseas transfer; (3) entrustment of processing or storage is necessary to conclude and perform a contract with the data subject and either (a) the matters in paragraph 2 are disclosed in the privacy policy established under Art. 30, or (b) those matters have been notified to the data subject by email or another method prescribed by Presidential Decree; (4) the recipient holds personal information protection certification under Art. 32-2 or another certification determined and published by the Protection Commission, and has taken both (a) the security measures needed to protect personal information and the measures needed to guarantee data subject rights, and (b) the measures needed to implement the certified matters in the country to which the data is transferred; or (5) the Protection Commission recognises that the personal information protection framework, the scope of data subject rights protection and the remedy procedures of the destination country or international organisation are substantially equivalent to the level under this Act. Paragraph 2 lists the five matters to be notified before consent under paragraph 1(1): the items of personal information to be transferred; the country, timing and method of transfer; the name of the recipient (for a legal person, its name and contact details); the recipient’s purpose of use and retention and use period; and the method, procedure and effect of refusing the transfer. Paragraph 3 requires notice and fresh consent where any of those matters changes. Paragraph 4 requires a controller transferring under the proviso to paragraph 1 to comply with the other provisions of this Act on overseas transfer, with Arts. 17 to 19 and with Chapter 5, and to take the protective measures prescribed by Presidential Decree. Paragraph 5 prohibits concluding an overseas transfer contract whose content violates this Act.
Triggers: No volume threshold. What matters is how broadly Korean law defines transfer: providing (including where the data is accessed from abroad), entrusting processing and storing abroad are all covered - so hosting Korean user data on offshore cloud, remote access by offshore operations teams and outsourcing processing to an offshore vendor are all overseas transfers requiring one of the five bases in Art. 28-8(1). The companion provisions matter too. Article 28-9 lets the Protection Commission order a controller to suspend an overseas transfer where the transfer is continuing or further transfers are expected and either (1) Art. 28-8(1), (4) or (5) has been breached, or (2) the recipient, or the destination country or international organisation, fails to protect personal information appropriately by comparison with this Act so that damage to data subjects has occurred or is markedly likely; a controller served with such an order may object to the Commission within 7 days of receipt. Article 28-10 allows reciprocal restrictions on controllers from countries that restrict transfers out of their own jurisdiction, except where required to perform a treaty or other international agreement. Article 28-11 applies Arts. 28-8 and 28-9 mutatis mutandis where a recipient under the proviso to Art. 28-8(1) transfers the data on to a third country.
Lead time: Estimate: 2-4 weeks for the ground (3) route (privacy policy disclosure or notification); 3-5 weeks for the separate-consent route including consent UI changes; the ground (4) certification route depends on the recipient obtaining certification and typically takes months.
Binding force: Article 28-8 is a mandatory statutory duty with direct enforcement: the Protection Commission can order the overseas transfer suspended under Art. 28-9, with only a 7-day window to object. Article 28-10 adds a reciprocity principle permitting corresponding restrictions on controllers from countries that restrict outbound transfers - a provision Chinese companies in particular should watch. Penalty amounts were not verified for this entry.
Validity: No fixed expiry, but subject to the standing risk of an Art. 28-9 suspension order. Version note: the current text relied on here is marked "in force 11 Sep 2026" under Act No. 21445 of 10 Mar 2026 (partial amendment) - one day before this verification. This pass did not compare that amendment article by article against Arts. 28-8 to 28-11 (Art. 28-8 still carries only the "newly inserted 14 Mar 2023" marker with no new amendment marker), so review the amendment rationale and the old/new comparison before relying on it. The Presidential Decree detail underpinning Art. 28-8(1)(3) and (4) was also not verified. Confidence is therefore medium.

Official source ↗Reviewed 2026-09-12

India

India DPDP Act restricted-country mechanism (s 16)

Low cost

Scope: A negative-list model, the inverse of the EU whitelist logic. Section 16(1) of the Digital Personal Data Protection Act, 2023 (No. 22 of 2023) provides that the Central Government may, by notification, restrict the transfer of personal data by a Data Fiduciary for processing to such country or territory outside India as may be so notified. Section 16(2) provides that nothing in the section restricts the applicability of any law in force in India that provides a higher degree of protection for, or restriction on, transfer of personal data by a Data Fiduciary outside India in relation to any personal data or Data Fiduciary or class thereof. Two consequences follow: transfers are permitted by default and only notified destinations are restricted; and sector-specific stricter rules prevail - existing localisation or transfer restrictions in finance, insurance or telecoms are not relaxed by this Act, and in practice they are often the binding constraint. Section 17(1) also disapplies Chapter II (except sub-sections (1) and (5) of section 8), Chapter III and section 16 where, among other cases, processing is necessary for enforcing any legal right or claim.
Triggers: No volume threshold and no general pre-transfer approval or contract requirement - the trigger is simply whether the Central Government has notified a restriction for a particular country or territory. An important limit on this research pass: it could not verify from an Indian official source (MeitY or the Gazette of India) (1) whether section 16 has been brought into force, (2) whether any restriction notification has been issued, or (3) the publication and commencement status of the Digital Personal Data Protection Rules and their provisions on processing outside India. This entry therefore verifies only the text of section 16 of the 2023 Act (from the official Gazette PDF); commencement and the subordinate rules are unverified and confidence is medium. Any operational call must be checked against MeitY and the Gazette of India for the current notifications and rules, and against the existing localisation and transfer restrictions of the relevant sector regulator (the Reserve Bank of India, IRDAI, the telecom authorities), which prevail under section 16(2).
Lead time: Estimate: 1-2 weeks in the normal case to compare the destination list and adjust contracts; where a destination is notified as restricted, migration typically takes 2-6 months depending on data volume and system coupling. Whether notifications carry a transition period was not verified in this pass.
Binding force: A restriction notified under section 16(1) is mandatory once issued, and section 16(2) makes clear the section does not cut down any higher protection or stricter restriction in other Indian law in force. The penalties for breaching section 16 and the enforcement procedure were not verified for this entry.
Validity: No concept of validity; the compliance position moves with Central Government notifications. Because a restriction can issue at any time, architectures relying on the default permission should stay portable (multi-region deployment capability, data portability). The commencement and subordinate-rule status for this entry is unverified - see the triggers note.

Official source ↗Reviewed 2026-09-12

Brazil

Brazil LGPD international data transfer (Arts. 33-36)

Medium cost

Scope: Chapter V of the LGPD (Law No. 13,709/2018). Article 33 lists nine grounds and permits an international transfer only where one of them holds: (I) it is to countries or international organisations that provide a degree of protection of personal data adequate to that provided for in the Law; (II) the controller offers and proves guarantees of compliance with the principles, data subject rights and data protection regime of the Law, in the form of (a) specific contractual clauses for a given transfer, (b) standard contractual clauses, (c) global corporate rules, or (d) regularly issued stamps, certificates and codes of conduct; (III) the transfer is necessary for international legal cooperation between public intelligence, investigation and prosecution bodies under instruments of international law; (IV) it is necessary to protect the life or physical safety of the data subject or a third party; (V) the national authority authorises the transfer; (VI) the transfer results from a commitment made under an international cooperation agreement; (VII) it is necessary for the execution of a public policy or a legal attribution of the public service, with publicity given under Art. 23(I) of the Law; (VIII) the data subject has given specific and highlighted consent to the transfer, with prior information about its international character clearly distinguished from other purposes; or (IX) it is necessary to meet the situations in Art. 7(II), (V) or (VI) of the Law. In practice the two routes a Chinese company actually uses are ground (VIII), specific and highlighted consent, and the contractual routes in (II)(a) and (b). The sole paragraph of Art. 33 allows the public-law entities referred to in the sole paragraph of Art. 1 of the Access to Information Law, within their legal competences and responsible within their activities, to request the national authority to assess the level of protection afforded by a country or international organisation. Article 34 provides that the national authority assesses that level, taking into account the general and sectoral rules of the legislation in force in the destination country or international organisation, the nature of the data, and the other listed factors and any other specific circumstances relating to the transfer. Article 35 gives the national authority the task of defining the content of the standard contractual clauses referred to in Art. 33(II) and of verifying specific contractual clauses for a given transfer, global corporate rules, or stamps, certificates and codes of conduct; the verification must consider the minimum requirements, conditions and guarantees observing the rights, guarantees and principles of the Law; the authority may require supplementary information or carry out verification of processing operations where necessary; it may designate certification bodies to perform this function under its supervision, whose acts it may review and, where non-compliant, subject to revision or annul; and Art. 35(5) provides that sufficient guarantees of observance of the general protection principles and data subject rights are also to be analysed against the technical and organisational measures adopted by the operator under Art. 46(1) and (2). Article 36 requires changes to the guarantees presented as sufficient to be communicated to the national authority.
Triggers: No volume threshold - Art. 33 applies to any transfer of personal data out of Brazil, which must fall within one of its listed grounds. The 2026 development: per the European Commission adequacy page as captured on 12 Sep 2026, the EU and Brazil adopted mutual adequacy decisions (the EU-side document dated 26 Jan 2026, announced jointly on 10 Feb 2026), described by the Commission as creating the biggest area of free and safe data flows in the world. For a Chinese company the practical meaning is that EU-Brazil flows are simplified by the mutual recognition while China-Brazil flows are not, so Chinese entities still rely on the contractual, global corporate rules or certification routes in Art. 33(II). This pass could not retrieve the text of ANPD’s standard contractual clauses regulation from an official source, so its clause structure, transition period and any requirement to submit to ANPD are unverified; confidence is therefore medium.
Lead time: Estimate: 3-6 weeks for the contractual route including aligning with the ANPD clause text and preparing the technical and organisational measures narrative; the global corporate rules route requires verification by the national authority and its timeline was not verified in this pass, so assess it per project.
Binding force: Article 33 is mandatory: an international transfer outside its listed grounds is not permitted. The content of the contractual, global corporate rules and certification routes is defined and verified by the national authority, so a self-drafted text is not a substitute. The specific penalties for unlawful international transfers under the LGPD were not verified for this entry.
Validity: Article 33 sets no expiry, but Art. 36 requires changes to the guarantees presented as sufficient to be communicated to the national authority, and Art. 35(4) lets the national authority review the acts of certification bodies and, where non-compliant, subject them to revision or annul them - so a basis obtained through certification can be unwound after the fact. The version and any transition period of the ANPD regulation were not verified in this pass.

Official source ↗Reviewed 2026-09-12

United Arab Emirates

UAE cross-border transfers: federal PDPL (Arts. 22-23) and DIFC Data Protection Law (Arts. 26-27)

Medium cost

Scope: The UAE runs two parallel regimes and the choice of location decides which applies. Onshore, Federal Decree-Law No. 45 of 2021 applies. Article 22 (cross-border transfer where a proper protection level is available) provides that personal data may be transferred outside the State in the following cases approved by the Bureau: 1. the State or Province to which the data is transferred has legislation addressing personal data protection, including the most significant provisions, measures, controls, stipulations and rules related to protecting the privacy and confidentiality of the data subject’s personal data and their ability to exercise their legal rights, and also has a judicial or regulatory authority imposing appropriate measures against the controller or processor; 2. the State joins a bilateral or multilateral agreement related to the protection of personal data concluded with the countries to which the data is transferred. Article 23 (cross-border transfer where a proper protection level is not available) provides that, notwithstanding Art. 22, personal data may be transferred outside the State where: a. companies operating in countries with no data protection laws may transfer data under a contract or agreement obliging the companies in such countries to adopt the measures, controls and requirements set out in the Decree-Law, including provisions forcing the controller or processor to adopt appropriate measures imposed by a judicial or regulatory authority in those countries as set out in the contract; b. the data subject has given explicit consent to the transfer, provided it does not contradict the public or security interest of the State; c. the transfer is necessary to fulfil obligations and establish rights before judicial entities, or to exercise or defend them; d. the transfer is necessary to sign or implement a contract between the controller and the data subject, or between the controller and third parties to serve the data subject’s interest; e. the transfer is necessary to implement an action related to international judicial cooperation; f. the transfer is necessary to protect the public interest. Article 23(2) provides that the Executive Regulations set out the controls and stipulations referred to in Art. 23(1) to be observed on transfer. In the DIFC free zone, DIFC Law No. 5 of 2020 (consolidated version, July 2025) applies. Article 26 (transfers out of the DIFC: adequate level of protection) permits processing involving a transfer from the DIFC to a third country or international organisation only if (a) an adequate level of protection is ensured by Applicable Law as set out in Arts. 26(2) and (3), including as regards onward transfers, or (b) it takes place in accordance with Art. 27. Article 26(2) lists the factors for the Commissioner’s determination: the rule of law, general respect for individuals’ rights and their ability to enforce them via administrative or judicial redress; access of a public authority to personal data; the existence of effective data protection law including rules on onward transfer; the existence and functioning of one or more independent, competent data protection or similar supervisory authorities with adequate enforcement powers; and international commitments and conventions binding on the third country or international organisation and its membership of multilateral or regional organisations. Article 26(3) lets the Commissioner make such a determination at his discretion on the basis of adequacy decisions of other competent data protection authorities that took the same factors into account. Article 26(4) requires the Commissioner to pass Regulations detailing his determinations, Art. 26(5) lets him repeal, amend or suspend adequacy status and issue amended Regulations, and Art. 26(6) confirms that processing under Art. 26 needs no specific authorisation or notification to the Commissioner beyond what other provisions require.
Triggers: Neither regime has a volume threshold. The DIFC route where adequacy is absent is Art. 27: Art. 27(1) permits a transfer to a third country or international organisation on condition that (a) the controller or processor has provided appropriate safeguards as described in Art. 27(2) and enforceable data subject rights and effective legal remedies are available; (b) one of the specific derogations in Art. 27(3) applies; or (c) the limited circumstances in Art. 27(4) apply. Article 27(2) lists the appropriate safeguards: (a) a legally binding instrument between public authorities; (b) Binding Corporate Rules subject to Art. 27(6); (c) standard data protection clauses adopted by the Commissioner in accordance with Regulations setting out a procedure for developing them; (d) an approved code of conduct under Art. 48 together with binding and enforceable commitments of the controller or processor in the third country or international organisation to apply the appropriate safeguards including as regards data subject rights; and (e) an approved certification mechanism under Art. 50 with the same binding and enforceable commitments. Article 27(3) lists the derogations: (a) explicit consent after being informed of the possible risks arising from the absence of an adequacy decision or appropriate safeguards; (b) necessity for the performance of a contract between the data subject and the controller or pre-contractual measures at the data subject’s request; (c) necessity for the conclusion or performance of a contract in the data subject’s interest between the controller and a third party; (d) necessity for reasons of Substantial Public Interest; (e) necessity or legal requirement in the interests of the DIFC, including the DIFC Bodies’ proper discharge of their functions; (f) necessity for the establishment, exercise or defence of a legal claim; (g) necessity to protect the vital interests of a data subject or others where the data subject is physically or legally incapable of giving consent; (h) a transfer made in compliance with Applicable Law and the data minimisation principle in Art. 9(1)(f) from a register intended to provide information to the public and open for viewing by the public or by anyone who can demonstrate a legitimate interest; (i) subject to Art. 28, a transfer necessary for compliance with an obligation under Applicable Law to which the Controller is subject, or made at the reasonable request of a regulator, police or other government agency or competent authority; (j) subject to international financial standards, a transfer necessary to uphold the legitimate interests of a Controller recognised in international financial markets, unless overridden by the Data Subject’s legitimate interests relating to their particular situation; and (k) a transfer necessary to comply with applicable anti-money laundering or counter-terrorist financing obligations, or for the prevention or detection of a crime. Points (i), (j) and (k) matter in practice - they cover transfers made on a regulator’s or law-enforcement request - so do not read Art. 27(3) as stopping at (h). Art. 27(6) separately bars a public authority subject to DIFC law from relying on Art. 27(3)(a), (b) or (c), or on Art. 27(4). The key open item onshore: Art. 28 requires the Council of Ministers, on the proposal of the Bureau’s Director General, to issue the Executive Regulations, and Art. 29 gives controllers and processors a fixed period from the issuance of those Regulations to regularise their position, extendable once by the Council for a similar period. Verification note: the month figures in those two articles could not be read from the text layer of the official Arabic PDF obtained in this pass (the numerals are not in extractable text), so no period is asserted here. The UAE Legislation portal returns 403 to every non-browser client, so its "Related legislations" panel could not be checked, and no Executive Regulations appear on the u.ae data protection page either. Whether the controls and stipulations delegated by the closing paragraph of Art. 23 are yet in place therefore cannot be confirmed, and the operational detail onshore remains uncertain - hence a medium confidence rating and a need to re-check the status of the Executive Regulations before relying on this entry.
Lead time: Estimate: 3-8 weeks for the DIFC contract or BCR route; 3-6 weeks for the onshore PDPL contract route, though the status of the Executive Regulations is unconfirmed and the text may need revision once it is clear. The procedure and timing for the Bureau approval referred to in Art. 22 were not verified in this pass.
Binding force: Both regimes are mandatory. DIFC appropriate safeguards must be accompanied by enforceable data subject rights and effective legal remedies, and the onshore Art. 23(a) contract must genuinely impose the Decree-Law’s measures, controls and requirements on the foreign company rather than offering a generic confidentiality undertaking. Penalty amounts under either regime were not verified for this entry.
Validity: DIFC adequacy status can be repealed, amended or suspended by the Commissioner under Art. 26(5), with amended Regulations issued where necessary, so track the Regulations version. The onshore timeline still hinges on the Executive Regulations: Art. 28 requires the Council of Ministers to issue them on the proposal of the Bureau’s Director General, and Art. 29 gives controllers and processors a fixed period from their issuance to regularise, extendable once by the Council for a similar period; the number of months in each article could not be read from the extractable text layer of the official Arabic text, so none is asserted. When checked on 12 Sep 2026 the UAE Legislation portal returned 403 to non-browser clients and the u.ae data protection page listed no Executive Regulations, so whether they have issued could not be confirmed.

Official source ↗Reviewed 2026-09-12

Saudi Arabia

Saudi PDPL transfer and disclosure outside the Kingdom (Art. 29)

Medium cost

Scope: Article 29(1) of the Personal Data Protection Law provides that, subject to Art. 29(2), a Controller may transfer personal data outside the Kingdom or disclose it to a party outside the Kingdom in order to achieve any of the following purposes: A. where it relates to performing an obligation under an agreement to which the Kingdom is a party; B. where it is to serve the interests of the Kingdom; C. where it relates to the performance of an obligation to which the Data Subject is a party; D. where it fulfils other purposes as set out in the Regulations. Article 29(2) sets the conditions that must be met: A. the transfer or disclosure must not cause any prejudice to national security or the vital interests of the Kingdom; B. there must be an adequate level of protection for personal data outside the Kingdom, at least equivalent to the level guaranteed by the Law and Regulations, according to the results of an assessment conducted by the Competent Authority in coordination with whomever it deems appropriate from the other relevant authorities; C. the transfer or disclosure must be limited to the minimum amount of personal data needed. Article 29(3) disapplies Art. 29(2) in cases of extreme necessity to preserve the life or vital interests of the Data Subject or to prevent, examine or treat disease. Article 29(4) provides that the Regulations set out the provisions, criteria and procedures related to implementing the article, including applicable exceptions for Controllers regarding the conditions in Art. 29(2)(B) and (C), as well as controls and procedures for such exemptions.
Triggers: No volume threshold. Article 29 is structured differently from the EU model: it first sets a purpose gate (the four grounds in Art. 29(1)) and then layers on three conditions (Art. 29(2)(A), (B) and (C)), all of which must be met. The operative point is Art. 29(2)(B): the adequate level of protection is determined by an assessment conducted by the Competent Authority (SDAIA) in coordination with whomever it deems appropriate from the other relevant authorities, so the adequacy call sits with the regulator, not the company. Article 29(2)(C) then requires per-transfer minimisation that must be demonstrable. An important limit on this pass: Art. 29(4) delegates the provisions, criteria and procedures - including the exceptions for Controllers from the Art. 29(2)(B) and (C) conditions and the controls and procedures for those exemptions - entirely to the Regulations, and the text of those Regulations (including the dedicated data transfer regulation) could not be retrieved from an official Saudi source in this pass. The current exemption list, the list of countries assessed as providing an adequate level, and whether a risk assessment or registration must be filed with SDAIA are therefore unverified. Confidence is medium and the SDAIA-published Regulations and transfer rules must be checked before relying on this entry.
Lead time: Estimate: 2-6 weeks for the purpose and condition analysis, the minimisation rationale and the contract terms. Where an exemption procedure under the Regulations is needed, its timeline was not verified in this pass and should be assessed per project.
Binding force: Article 29 is mandatory: a transfer or disclosure outside the Kingdom that fails the Art. 29(1) purpose gate or the Art. 29(2) conditions is not permitted. The national security and vital interests condition in Art. 29(2)(A) leaves the regulator wide discretion, which calls for particular care with data touching government, energy or defence customers. The penalties and enforcement procedure for breaching Art. 29 were not verified for this entry.
Validity: Article 29 sets no expiry, but the protection level under Art. 29(2)(B) depends on the Competent Authority’s assessment, and a change in that assessment affects the lawfulness of the transfer. This entry relies on the amended English text published by SDAIA (V2, 23 April 2023); Art. 43 of that text provides that the Law comes into force 720 days after publication in the Official Gazette, and this pass verified neither the publication date nor the resulting entry-into-force date, nor the version and amendment history of the Regulations.

Official source ↗Reviewed 2026-09-12

Mechanism information comes from our content corpus, each entry with its official source and review date. The rule-based pointers above follow your selections and do not decide which mechanism you should sign. Validate with your trusted counsel before execution.

Content as of 2026-09-12 · corpus 2026.09|Compiled from public official sources with links and review dates for compliance decision support. Rules change; have licensed professionals review before external disclosure, regulatory filing or contractual commitments.