INTRODUCTION Contributed by: Christian Schröder, Orrick
International data transfers One of the most significant challenges in data privacy is the issue of cross-border data transfers. As data transfers are part of everyday business, regulators must address the complexities of ensuring that per - sonal data transferred to other jurisdictions remains adequately protected. This has led to the develop - ment of various mechanisms such as standard con - tractual clauses (SCCs), binding corporate rules (BCRs) and adequacy decisions, which enable the international transfer of personal data in compliance with the respective data protection principles. Many jurisdictions, particularly in the MENA region, have recently adopted this approach and published data transfer regulations that in some instances require specific approval by state authorities. For example, in 2024, Saudi Arabia published four different forms of SCCs and issued new guidelines on the use of BCRs. In the United States, national‑security‑driven controls have been tightened. New federal rules constrain cer - tain transfers of bulk sensitive US personal data to countries of concern, and the Protecting Americans’ Data from Foreign Adversaries Act limits sales by data brokers to designated countries or controlled entities. These regimes sit alongside sectoral rules and state privacy laws, expanding diligence and contractual controls for global vendor chains. China has completed the tri‑path outbound data transfer framework under the Personal Informa - tion Protection Law (PIPL). Following the easing of thresholds and exemptions in 2024, 2025 saw further guidelines and, crucially, the Measures for Certifica - tion of Cross‑Border Personal Information Transfers (effective since January 2026). Companies now have a choice of security assessment, standard contracts, or certification. The UK’s new DUAA establishes a new data protec - tion standard for transfers, mandating the secretary of state to carry out a data protection test in relation to transfers of personal data to a third country or inter - national organisation. In the EU, international data transfers are an endless story. In 2025, the European Commission renewed
the two adequacy decisions for the United Kingdom. An adequacy decision for data transfers to Brazil is expected soon. Due to political developments and increasing tensions with the US, doubts have been raised in Europe about the continued validity of the EU–US Data Privacy Framework (DPF) for the transfer of personal data between the EU and the US. In September 2025, the EU General Court (EGC; Case T-553/23) dismissed an action for annulment of the DPF for the transfer of personal data between the EU and the US, thereby confirming the DPF. An appeal is pending before the European Court of Justice (CJEU). The current situation in the EU is precarious for many companies relying on SCCs, and particularly for small and medium-sized enterprises with international ties, as an annulment of the DPF would necessitate rely - ing on SCCs for data transfers to the US. According to the Schrems II decision of the CJEU and based on the recommendations 01/2020 of the European Data Protection Board (EDPB), the use of SCCs necessi - tates an assessment of the data protection level of the respective third country (a transfer impact assessment or TIA). According to the EDPB, such TIAs require a six-step review process, including a detailed examina - tion of the legal enforcement system and surveillance laws of the recipient country. This necessitates the help of local experts and leads to increasing costs for companies, which for SMEs leads to enormous challenges. Enforcement In the EU, regulators continued to focus on adtech, dark patterns, the processing of sensitive data in advertising, and the processing of children’s data. One particular focus of European data protection authori - ties has always been international data transfers. Examples are the EUR530 million fine imposed by the Irish Data Protection Commissioner against a social media platform provider for unlawful data transfers to China, and the European Data Protection Supervisor’s decision to refuse a request by the European Invest - ment Bank to transfer data to a number of non-EU/ EEA countries, including Brazil, Turkey, India and Fiji.
8 CHAMBERS.COM
Powered by FlippingBook