🌐 International Transfers & TIA Matrix

International data transfers, transfer impact assessments (TIAs), adequacy and SCCs. See also the China / CAC repository.

<WRAP center round important 90%> ⚠️ NOT LEGAL ADVICE — decision-support only. This matrix is a simplified, generalised aid for spotting which transfer mechanism likely applies. It is not a legal opinion and must not be relied on for a specific transfer without verifying the current primary law and taking qualified advice. Data-protection transfer law changes frequently; entries can be out of date the moment they are written.

• As of: 2026-09-07. Re-verify every entry against the primary source before use.
• Volatile items (🔶): EU–US DPF (subject to ongoing litigation), India DPDP Rules (phasing in to ~2027, no restricted-country list yet), UAE federal implementing regulations (not yet gazetted), Indonesia implementing GR (pending), Taiwan PDPC (operationalising the Nov-2025 amendment).
• Scope limits: buckets are generalisations; a destination’s real risk depends on the specific data, recipient, purpose, sector and government-access exposure. Sub-national/sector rules (e.g. US state laws, DIFC/ADGM vs UAE mainland, RBI localisation) can override the country-level view.
• “Access = transfer”: remote access to personal data from a third country is itself a transfer (EDPB Guidelines 05/2021).
• The exporter’s law sets the conditions (Table A), evaluated per transfer. One data flow can trigger several regimes at once.
• Cross-checked (2026-09) against DLA Piper Data Protection Laws of the World, Linklaters Data Protected, and Chambers Global Practice Guides 2026.

Table A — Exporter regimes (the “from” axis)

Table B — PERSONAL DATA transfer — destination buckets from an EU/EEA exporter (UK/CH ≈ same)

These buckets are the EU/EEA exporter view (adequacy is an EU concept). For any other exporter, that country’s own regime governs — see Table A.

Table C — SYSTEM ACCESS (remote admin/support) — EU/EEA as exporter / source of the remote access — mitigation lens

Same mechanism as Table B, but technical measures change the residual risk. The decisive question: does the third-country admin need PLAINTEXT personal data?

Table D — SYSTEM SUPPORT OUT OF INDIA (Indian team remotely supporting your systems)

Perspective: India as the location of the remote support/access, supporting a controller elsewhere (e.g. an EU/EEA exporter). If Indian staff can reach personal data, that access is a transfer to India (EDPB 05/2021). India (DPDPA) does not restrict inbound access, but the Indian entity is usually a processor / data-fiduciary with its own contract & security duties; India is not EU-adequate (broad state access → factor into the TIA). RBI payment-data localisation applies if payment data is in scope.

Table E — US DOJ Data Security Program (EO 14117) — bulk-sensitive-data export controls 🔶

A US-outbound national-security control (28 CFR Part 202; EO 14117; final rule effective 8 Apr 2025, affirmative compliance obligations from 6 Oct 2025, reporting/enforcement phasing through 2026). Separate from the privacy/adequacy analysis — it turns on the recipient being a country of concern (China incl. HK/Macau, Cuba, Iran, North Korea, Russia, Venezuela) or a covered person (entities ≥50% owned by / organised in a CoC; their employees/contractors; individuals resident in a CoC). Covers bulk US sensitive personal data (genomic/‘omic, biometric, precise geolocation, health, financial, identifiers) and US government-related data (any volume). Cross-link: offshoring to India (Table D) is not a CoC — but a support provider that is a covered person (e.g. ≥50% CoC-owned, or CoC-resident staff) can trigger this.

Table F — HEALTH & special-category data (overlay on Tables A–C)

Health data is special-category (GDPR Art. 9). A transfer must satisfy an Art. 9(2) condition on top of the Chapter V mechanism, and the TIA must treat it as sensitive — plaintext exposure to a high-risk state generally cannot be neutralised by encryption (EDPB Rec 01/2020 UC 6/7). Watch EU secondary-use rules (EHDS) and national health-hosting regimes (e.g. FR HDS) that can require EU/EEA hosting.

Cross-cutting frameworks

Per-regime health specifics

“Public-body extras” = where public vs private hospitals diverge. The split bites at: FR SecNumCloud / “cloud au centre” (State/public sector), German Land hospital laws (+ church law for confessional hospitals), and public-scope localisation (Indonesia GR 71/2019, Russia public bodies, EHDS Health Data Access Bodies). UAE, Australia (MHR), Russia, China and US HIPAA/EO 14117 apply by data type / actor role regardless of public vs private.

Sources

• EC — adequacy decisions
• EC — EU–US data transfers (DPF)
• India — DPDP Rule 15 (transfers)
• Malaysia — CBDT guidelines 2025
• Indonesia — PDP Law transfer requirements
• Taiwan — PDPA 2025 amendment / PDPC
• UAE — PDPL (DLA Piper)
• DLA Piper — Data Protection Laws of the World
• Linklaters — Data Protected
• Chambers — Data Protection & Privacy 2026
• US DOJ NSD — Data Security Program (EO 14117)
• 28 CFR Part 202 (eCFR)
• EHDS — Regulation (EU) 2025/327
• EDPB Recommendations 01/2020 (supplementary measures)
• France — HDS hosting (CSP Art. L.1111-8, Légifrance)
• Germany — §203 StGB (professional secrecy)
• Australia — My Health Records Act 2012 (s.77)
• US HHS — HIPAA Business Associates

The interactive TIA matrix tool on privacydesign.ch is generated from the machine-readable block below. Edit the block to update the tool (the daily site sync regenerates it). Keep the YAML valid.

Machine-readable matrix omitted here — use the interactive TIA matrix tool.