International transfer review

Cross-Border Data Transfers

How hosting, support, subprocessors, backup regions, SCCs, UK transfer terms, and data-transfer review fit into onboarding.

How this page supports country onboarding

Country pages link here for EU/EEA, UK, and regulated data workflows.

Important note

This page is general onboarding and review information. It is not legal, tax, regulatory, cybersecurity, financial, or compliance advice, and it does not create certification claims or service commitments. Final obligations belong in signed agreements and approved project documents.

Triggers

When transfer review is needed

Transfer review may be needed when personal data is hosted, accessed, supported, backed up, logged, processed by subprocessors, or otherwise transferred across jurisdictions.

Mechanisms

Transfer mechanisms

Depending on jurisdiction and project context, transfer terms may include DPA provisions, EU Standard Contractual Clauses, UK IDTA/Addendum, subprocessor review, technical and organizational measures, and transfer-impact support where agreed.

Architecture

Architecture decisions affect transfer posture

Client-owned cloud, region selection, no-production-data-access models, limited support access, backup region, log region, and AI/vendor tooling can materially affect transfer analysis.

Preparation

Buyer checklist

Identify client and end-user countries.

Identify hosting, backup, log, support, and subprocessor locations.

Confirm whether SCCs or UK transfer terms are needed.

Confirm whether data residency is required.

Confirm whether support access can be limited or avoided.

Review materials

Available artifacts

Transfer review notes
SCCs
UK transfer terms
Hosting region record
Support access model

Local overlays

Country-specific notes

United States

U.S. state privacy requirements may need review based on client location, user location, data categories, and project role.
California privacy review may be relevant when a project involves California residents, sale/share concepts, cookies, analytics, or consumer requests.
Healthcare, financial, education, payment, government, biometric, children, or employment data requires additional review before scope approval.
Transfer and support mechanisms to review: DPA when applicable, Client-approved subprocessors, Data-transfer review for cross-border support, SCCs if EU/EEA data is involved.
Data residency options to discuss: Client-owned U.S. cloud, VarenyaZ-managed cloud by agreement, U.S. region hosting, No-production-data-access model, Limited production access model.

United Kingdom

UK projects may require UK IDTA/Addendum or other appropriate UK transfer terms.

European Union / EEA

EU/EEA projects may require SCCs and transfer review for data moved outside the EU/EEA.

South Korea

South Korea Personal Information Protection Act review may be relevant where personal information is collected, processed, stored, transferred, or accessed for Korean users or clients.
Cross-border transfer, entrusted processing, storage, and subprocessor review should be identified before proposal finalization.
Resident registration numbers, health data, financial data, children data, biometric data, employment data, AI use cases, and regulated-sector projects require additional review.
Transfer and support mechanisms to review: DPA when applicable, Client-approved subprocessors, Cross-border transfer review, Korea PIPA review when Korean personal information is in scope.
Data residency options to discuss: Client-owned South Korea cloud, South Korea region hosting by agreement, Limited production access model, No-production-data-access model.

Canada

PIPEDA or provincial privacy review may apply depending on client, user location, and data categories.
Transfer and support mechanisms to review: DPA when applicable, Subprocessor review, Data-transfer review.
Data residency options to discuss: Client-owned Canadian cloud, Canadian hosting by agreement, Limited production access model.

Australia

Privacy Act and Australian Privacy Principles review may be relevant where personal information is processed.
Transfer and support mechanisms to review: DPA when applicable, Subprocessor review, Cross-border disclosure review.
Data residency options to discuss: Client-owned Australian cloud, Australian hosting by agreement, Limited production access model.

Singapore

Singapore PDPA review may apply where personal data is collected, used, disclosed, or transferred.
Transfer and support mechanisms to review: DPA when applicable, Subprocessor review, Cross-border transfer review.
Data residency options to discuss: Client-owned Singapore cloud, Singapore hosting by agreement, Limited production access model.

United Arab Emirates

UAE personal data protection review may be relevant where personal data is processed or transferred.
Transfer and support mechanisms to review: DPA when applicable, Subprocessor review, Cross-border transfer review.
Data residency options to discuss: Client-owned UAE cloud, UAE hosting by agreement, Limited production access model.

External references

Framework references

European Commission SCCs

Next review

Connect this review to country onboarding

Use this page with the country onboarding guide so your legal, procurement, security, privacy, finance, and engineering teams have the right review path before contract signature.