International Data Transfers in 2026
Transferring personal data across borders requires legal basis under most privacy regulations. The post-Schrems II landscape has made cross-border data transfers more complex, requiring organizations to conduct transfer impact assessments and implement supplementary measures.
Transfer Mechanisms
Adequacy Decisions
The European Commission recognizes certain countries as providing adequate data protection:- EU-US Data Privacy Framework (replaced Privacy Shield)
- UK, Japan, South Korea, Canada (commercial), and others
- No additional safeguards required for transfers to adequate countries
Standard Contractual Clauses (SCCs)
Standardized contract terms approved by the European Commission:- Module 1: Controller to Controller
- Module 2: Controller to Processor
- Module 3: Processor to Processor
- Module 4: Processor to Controller
Binding Corporate Rules (BCRs)
Internal rules for multinational companies:- Approved by lead supervisory authority
- Applies to all group entities
- Expensive and time-consuming to implement
- Suitable for large organizations with frequent intra-group transfers
Transfer Impact Assessment (TIA)
Required for SCCs and BCRs:
- Identify the transfer and its legal basis
- Assess the laws of the recipient country
- Determine if those laws undermine the safeguard
- Implement supplementary measures if needed
- Document the assessment
Supplementary Measures
- Technical: Encryption with keys retained by exporter
- Contractual: Additional commitments beyond SCCs
- Organizational: Access controls, transparency reports
India DPDP Act Requirements
The DPDP Act allows transfers to countries not on the government's restricted list. Key requirements:
- No transfer to countries specifically blocked by government notification
- Contractual safeguards recommended
- Consent for cross-border transfer may be required
- Data localization for specific categories may apply
Where SuperClue Fits
SuperClue does not map data flows. Its DPDP framework scan includes a cross-border transfer check that asks for evidence of your transfer arrangements.