Cross-Border Data Transfer
The transmission of personal data from one jurisdiction to another, subject to GDPR transfer mechanisms such as Standard Contractual Clauses or adequacy decisions when EU data is involved.
Last reviewed: 2026/05/18
Definition
Why It Matters for Lawyers
Frequently Asked Questions
- Q: Does sending an email with client personal data to a US law firm constitute a cross-border transfer requiring SCCs?
- Technically yes, if the data relates to EU residents and the US firm is not covered by an adequacy mechanism. In practice, law firms rely on SCCs embedded in engagement terms or data sharing agreements. Firms should review whether their standard client engagement documentation and vendor contracts address this.
- Q: Are SCCs automatically sufficient, or is additional analysis required?
- SCCs are a necessary but potentially insufficient safeguard. Post-Schrems II, firms must also conduct a transfer impact assessment evaluating whether the law of the destination country — particularly government access rights — undermines the protection that the SCCs are meant to guarantee. --- *Last reviewed: 2026-05-19 by LawyerAI Editorial Team.*
Last reviewed: 2026/05/18. Definitions are written by the LawyerAI Editorial team. We do not accept affiliate commissions; Featured placement is clearly labeled and does not influence editorial content.