Personal data now crosses borders every time a SaaS tool syncs, a support engineer logs in from another country or an AI agent calls a model hosted in another region, and each crossing needs a lawful transfer route in the exporting country. This map sets out how the main regimes control those transfers: the EU and EEA, the United Kingdom, Switzerland, the United States, China, India, Brazil and Japan, with the instrument each one uses (adequacy, standard contracts, binding corporate rules, certification, consent or state approval) and its current status. It is written for privacy, security and identity leads who have to decide which mechanism covers a given data flow and what evidence to keep. It goes deeper on transfers than the Global Privacy Regulatory Map, which covers each law's wider scope, breach clocks and penalties. Status was checked against the regulator or official text in October 2026.
Key takeaways
- Three families of transfer rule. The EU model (adequacy first, then contracts or BCRs with a risk assessment) is copied by the UK, Switzerland and Brazil; Japan relies on consent, equivalence or a conforming system; China uses volume thresholds and state approval.
- Contracts are not enough on their own. Since Schrems II (16 July 2020), EU SCCs need a documented assessment of the destination's laws, and the Meta (EUR 1.2 billion) and Uber (EUR 290 million) decisions show the cost of getting it wrong.
- The US now restricts outbound data too. The Department of Justice Data Security Program (28 CFR Part 202), in effect since 8 April 2025, prohibits or restricts some transfers of bulk sensitive data to six countries of concern.
- Thresholds decide the route in China. Under the CAC provisions effective 22 March 2024, volume of personal information since 1 January decides between exemption, standard contract or certification, and a CAC security assessment.
- Machine access is a transfer route. Service accounts, API integrations and AI agents that make data available to a recipient abroad trigger these rules exactly as a file export does, so the identity inventory is part of the transfer inventory.
Regulations and frameworks at a glance
| Regime | Main transfer instruments | Assessment required | Regulator | Status (October 2026) |
|---|---|---|---|---|
| EU and EEA: GDPR Chapter V (Art. 44 to 49) | Adequacy decisions (Art. 45); SCCs under Implementing Decision (EU) 2021/914, BCRs, codes and certification (Art. 46 and 47); derogations (Art. 49) | Transfer impact assessment under SCC Clause 14 and EDPB Recommendations 01/2020 | National supervisory authorities; EDPB | SCCs of 4 June 2021 in force; Commission developing additional SCCs for importers already subject to the GDPR |
| United Kingdom: UK GDPR as amended by the Data (Use and Access) Act 2025 | UK adequacy regulations; IDTA; UK Addendum to the EU SCCs; UK BCRs; Art. 49 exceptions | Transfer risk assessment, now the statutory "data protection test" of "not materially lower" protection | Information Commissioner's Office | IDTA and Addendum in force since 21 March 2022; ICO guidance updated 15 January 2026 |
| Switzerland: revised FADP and Data Protection Ordinance | Federal Council adequacy list; EU SCCs with Swiss adaptations; BCRs | Yes, for contractual safeguards | Federal Data Protection and Information Commissioner (FDPIC) | US added for certified companies under the Swiss-US DPF from 15 September 2024 |
| United States: DOJ Data Security Program, 28 CFR Part 202 | Not a transfer permission regime; prohibits data brokerage with countries of concern and restricts vendor, employment and investment agreements | Due diligence and audit for restricted transactions; CISA security requirements | Department of Justice, National Security Division | In effect 8 April 2025; due diligence, audit and reporting duties from 5 October 2025 |
| China: PIPL Art. 38 to 40 and CAC Provisions on Promoting and Regulating Cross-Border Data Flows | CAC security assessment; standard contract (filed); personal information protection certification; exemptions | Personal information protection impact assessment before export | Cyberspace Administration of China | Provisions effective 22 March 2024; assessment results valid three years |
| India: DPDP Act 2023, s. 16 | Transfers allowed by default; government may restrict named countries by notification | No general transfer assessment | Data Protection Board of India; Central Government | DPDP Rules phasing in; no restricted-country notification confirmed here |
| Brazil: LGPD Art. 33 and Resolution CD/ANPD 19/2024 | ANPD adequacy; ANPD standard contractual clauses; global corporate rules (BCRs); specific clauses; other Art. 33 grounds | Yes, within the contract and governance programme | Autoridade Nacional de Proteção de Dados (ANPD) | Transition to ANPD clauses ended 23 August 2025; mutual EU adequacy announced 10 February 2026 |
| Japan: APPI Art. 28 | Consent after information on the foreign system; equivalent country (EU and UK); recipient with a conforming system | Ongoing measures for conforming-system recipients | Personal Information Protection Commission (PPC) | EU adequacy for Japan in place, first review published 4 April 2023 |
Scope: who and what is covered
Most regimes regulate the act of making data available to a separate recipient abroad, not where the data physically sits. The details decide whether a flow is caught.
- EU test: EDPB Guidelines 05/2021 (version 2.0, adopted 14 February 2023) define a transfer with three cumulative criteria: the exporter is subject to the GDPR for the processing; it discloses or makes data available to another controller or processor; and that importer is in a third country or is an international organisation, whether or not the GDPR also applies to it. An employee of the same controller reading a database from a hotel abroad is not a transfer, but the moment that employee shares the data with another company there, it is.
- UK test: the ICO's three questions are whether the UK GDPR applies, whether you initiate the transfer, and whether the receiver is a separate legal entity. A UK processor returning data to its overseas controller is not making a restricted transfer, because the controller initiates it. The rules apply to "even small, infrequent" transfers.
- China: the PIPL rules attach to the handler that provides personal information outside China, with thresholds counted cumulatively from 1 January of the current year. Data collected abroad and sent into China for processing without adding domestic personal information is exempt.
- United States: 28 CFR Part 202 is about access, not export. It applies to US persons whose transactions could give a country of concern or covered person access to bulk sensitive personal data or US government-related data, including through a vendor or employee.
- Japan: Art. 28 covers any provision of personal data to a third party in a foreign country, and the business must give the person information on that country's protection system and the recipient's measures before asking for consent.
Key obligations
The table below maps the decision an exporter makes in each regime, in the order the law expects it to be made. Use the Standard Contractual Clauses (SCCs) Guide for module choice and Clause 14, the Binding Corporate Rules (BCRs) Guide for intra-group programmes and the EU-US Data Privacy Framework Guide for US recipients.
| Regime | Step 1 | Step 2 | Step 3 | Last resort |
|---|---|---|---|---|
| EU and EEA | Is the destination adequate? For the US, is the recipient certified under the DPF? | Choose an Art. 46 tool: SCC module, BCRs, code or certification | Run the six-step EDPB roadmap and add supplementary measures where the assessment shows a gap | Art. 49 derogations such as explicit consent or contract necessity, interpreted narrowly |
| United Kingdom | UK adequacy regulations (including the UK extension to the DPF, the "UK-US data bridge") | IDTA, or the Addendum alongside EU SCCs, or UK BCRs | Transfer risk assessment showing protection is "not materially lower" | Art. 49 exceptions, shown to be necessary and proportionate |
| Switzerland | Federal Council adequacy list, including certified US companies | EU SCCs adapted for Swiss law, or BCRs | Risk assessment of the destination | Statutory exceptions |
| China | Check exemptions (contract with the individual, HR management, emergencies, under 100,000 people, free trade zone negative lists) | Count volumes: 100,000 to 1 million people, or under 10,000 sensitive, means standard contract or certification | Over 1 million people, over 10,000 sensitive, important data, or any CIIO export means CAC security assessment | Separate consent and notice to individuals apply whichever route is used |
| Brazil | ANPD adequacy for the destination | Adopt the ANPD standard clauses unaltered, or obtain approval of global corporate rules or specific clauses | Document safeguards within the governance programme | Other Art. 33 grounds such as specific consent or contract performance |
| Japan | Is the recipient in an equivalent country (EU, UK)? | Does the recipient have a system conforming to PPC standards? | Otherwise obtain consent after explaining the foreign country's system and the recipient's measures | Statutory exceptions |
| India | Check any notification restricting the destination under s. 16(1) | Check sectoral rules, which prevail under s. 16(2) (for example financial regulators) | Apply ordinary DPDP duties to the processor contract | Not applicable |
| United States (outbound) | Is the counterparty a country of concern or covered person? | Is the data over a bulk threshold (for example 100 US persons for genomic data, 1,000 for biometric or precise geolocation, 10,000 for health or financial, 100,000 for covered identifiers)? | Data brokerage is prohibited; vendor, employment and investment agreements need CISA security requirements and due diligence | DOJ licences |
Adequacy recognitions that matter most
The EU list (as of October 2026) is Andorra, Argentina, Brazil, Canada (commercial organisations), the Faroe Islands, Guernsey, Israel, the Isle of Man, Japan, Jersey, New Zealand, the Republic of Korea, Switzerland, the United Kingdom, the United States (DPF participants only), Uruguay and the European Patent Organisation. Adequacy lets data flow "without any further safeguard being necessary", but it is recipient-specific for Canada and the US: a US recipient that is not on the DPF list still needs SCCs and an assessment.
Timeline and current status
| Date | Event | Effect on transfers |
|---|---|---|
| 16 July 2020 | CJEU Schrems II (C-311/18) | Privacy Shield invalid; SCCs valid but exporters must verify protection and suspend if it cannot be ensured |
| 18 June 2021 | EDPB Recommendations 01/2020 version 2.0 | Six-step roadmap and supplementary measures |
| 27 June 2021 | Decision (EU) 2021/914 in force | Old SCCs repealed from 27 September 2021; old contracts valid until 27 December 2022 |
| 21 March 2022 | UK IDTA and Addendum in force | Old EU SCCs for UK transfers allowed in new contracts only until 21 September 2022 and in existing ones until 21 March 2024 |
| 22 March 2024 | China CAC cross-border provisions | Higher thresholds and broad exemptions |
| 23 August 2024 | Brazil Resolution CD/ANPD 19/2024 | ANPD clauses mandatory for contract-based transfers from 23 August 2025 |
| 15 September 2024 | Swiss-US DPF | Certified US companies recognised by Switzerland |
| 8 April 2025 | US DOJ Data Security Program | Prohibited and restricted transactions with countries of concern |
| 3 September 2025 | EU General Court dismisses the Latombe challenge to the DPF | DPF remains valid; an appeal to the Court of Justice was possible |
| December 2025 and 10 February 2026 | EU renews UK adequacy; EU and Brazil mutual adequacy | UK and Brazil flows rely on adequacy |
| 15 January 2026 | ICO updated international transfers guidance | Aligns the TRA with the DUAA data protection test |
Items to watch: the Commission's additional SCCs for importers already subject to the GDPR (no adoption date published); any further challenge to the DPF and the US surveillance safeguards it depends on; India's first notification under s. 16(1); and the completion of the DPDP Rules phase-in.
Enforcement and penalties
- Meta Platforms Ireland (EUR 1.2 billion): the Irish Data Protection Commission's decision of 12 May 2023, announced on 22 May 2023, found that the 2021 SCCs plus Meta's supplementary measures did not address the risks the CJEU identified, a breach of Art. 46(1). It ordered Meta to suspend future US transfers within five months and stop processing unlawfully transferred data within six months.
- Uber (EUR 290 million): the Dutch Autoriteit Persoonsgegevens fined Uber in August 2024 for transferring drivers' data, including licences, location data, payment details, identity documents and in some cases criminal and medical data, to the US for over two years without a transfer tool after it stopped using SCCs in August 2021. Uber has since moved to the DPF and said it would object.
- GDPR ceiling: infringements of Art. 44 to 49 fall in the higher tier of Art. 83(5), up to EUR 20 million or 4% of worldwide annual turnover, and supervisory authorities can also order transfers suspended under Art. 58(2)(j).
- China: PIPL Art. 66 allows fines of up to RMB 50 million or 5% of annual revenue for grave violations, and the CAC can stop an export that has not followed the required route.
- United States: 28 CFR Part 202 is enforced by the DOJ National Security Division, and the reporting duties added on 5 October 2025 (annual reports and reports of rejected prohibited transactions) create a paper trail regulators can test.
What it means for AI agents and non-human identities
Transfer rules are written around recipients, but in practice data moves through credentials. Every service account, OAuth grant, API key and agent tool connection that lets a foreign recipient read personal data is a transfer path, and the transfer inventory is only as good as the identity inventory behind it.
- Integrations as transfers: a SaaS connector that copies CRM records to a vendor's US region is a transfer to that vendor. The Salesloft Drift breach shows how far one integration token can reach into personal data held in hundreds of tenants. See the Third-Party Access Guide.
- Agents and model endpoints: an AI agent that sends a prompt containing customer data to a model hosted outside the exporting region creates a transfer to the model provider, and any tool the agent calls may create more. Record the hosting region of each model endpoint and tool in the record of processing. See the AI and GDPR Guide.
- Remote administration: a foreign support engineer at a vendor is a separate recipient, so their access is a transfer even if the data never leaves an EU data centre. Scope privileged access by region with just-in-time grants. See the JIT Access Guide.
- Keys as a supplementary measure: the EDPB treats encryption as effective only where the importer and the authorities of the destination cannot access the keys. Holding keys in the exporting region and keeping the key administrators there is an identity control as much as a cryptographic one. See the Cryptographic Key Management Guide.
- US outbound rule and engineers: under 28 CFR Part 202, an employment or vendor agreement that gives a covered person access to bulk data is a restricted transaction, so access reviews for offshore staff and contractors become a compliance control.
Compliance steps
- Build the transfer inventory from the data map: for each processing activity, list the recipient entity, its country, the data categories, volumes and the access path (human, service account, integration, agent). Start from the Data Mapping and ROPA Guide.
- Apply each exporting regime's test: use the EDPB three criteria and the ICO three questions to remove flows that are not transfers, then count volumes for China and screen counterparties for the US rule.
- Pick the instrument per flow: adequacy or DPF certification first, then SCCs, IDTA or Addendum, BCRs, ANPD clauses or the China standard contract, with derogations only for occasional transfers.
- Assess and document: run the transfer impact or risk assessment, record supplementary measures (encryption with exporter-held keys, pseudonymisation, access restrictions), and keep it available for the regulator.
- File where required: file the China standard contract with the provincial CAC, apply for a CAC security assessment when thresholds are met, and seek ANPD approval for specific clauses or global corporate rules.
- Bind the access path: restrict tokens and service accounts that reach foreign recipients to the minimum data, log their use, and revoke them when a contract ends.
- Re-evaluate: review at least annually and on any trigger: a new sub-processor, a change in destination law, an adequacy decision or court ruling, or a government access request reported under SCC Clause 15.
| Framework | Where transfer controls sit |
|---|---|
| NIST CSF 2.0 | GV.OC-03 legal requirements; GV.SC-05 supplier contracts; ID.AM-07 data inventories; PR.DS-02 data in transit |
| NIST SP 800-53 Rev. 5 | SA-9(5) processing, storage and service location; PT-2 authority to process PII; SC-12 key management |
| ISO/IEC 27001:2022 Annex A | 5.20 supplier agreements; 5.31 legal requirements; 5.34 privacy and protection of PII |
Practitioner checklist
- Transfer register links each flow to a recipient entity, country, mechanism, assessment and owner.
- US recipients relying on the DPF are checked against the live participant list, with SCCs ready as a fallback.
- UK flows use the IDTA or Addendum; no contract still relies on the old EU SCCs alone.
- China exports are counted from 1 January each year against the 100,000, 1 million and 10,000 sensitive thresholds.
- Brazilian contracts use the ANPD standard clauses unaltered, or have ANPD approval for alternatives.
- Counterparties and offshore staff are screened against 28 CFR Part 202 countries of concern for bulk data.
- Every integration, service account and AI agent that reaches a foreign recipient is in the inventory with its data scope.
- Encryption keys for sensitive transfers are held and administered in the exporting region.
- Government access requests received by importers are logged and reported to exporters.
- Assessments carry a review date and a named reviewer.
Standards and references
- EUR-Lex: Commission Implementing Decision (EU) 2021/914 on standard contractual clauses
- European Commission: Adequacy decisions
- EDPB: Recommendations 01/2020 on supplementary measures
- EDPB: Guidelines 05/2021 on the interplay between Article 3 and Chapter V
- ICO: A brief guide to international transfers
- Cyberspace Administration of China: Provisions on Promoting and Regulating Cross-Border Data Flows
- US Department of Justice: Data Security Program
- Japanese Law Translation: Act on the Protection of Personal Information
Related NHI Mgmt Group resources: Global Privacy Regulatory Map · GDPR Compliance Guide for Security Teams · UK GDPR and Data Protection Act 2018 Guide · China PIPL Guide · Data Sovereignty and Residency Guide. This guide summarises international data transfer rules as of October 2026 and is not legal advice.