Data transfers outside primary jurisdiction use SCCs, BCRs, or adequacy decisions
Why it matters
GDPR Art. 44 prohibits transfers of EU personal data to third countries without an appropriate safeguard — Standard Contractual Clauses (SCCs), Binding Corporate Rules, or a valid adequacy decision such as the EU-US Data Privacy Framework. Most AI-built apps on Supabase, Vercel, or AWS use US-region infrastructure by default and integrate US-based analytics and email services, making every EU user's data a cross-border transfer requiring documentation. GDPR Art. 28 additionally requires written agreements with all processors, which must address the transfer mechanism. ISO-27001:2022 A.5.34 requires privacy controls to account for jurisdictional data flow restrictions. Undocumented transfers are a standalone violation even if the underlying data handling is otherwise lawful.
Severity rationale
Medium because the violation is procedural rather than immediately harmful, but unresolved cross-border transfer gaps expose the business to enforcement action that can prohibit data processing entirely until remediated.
Remediation
Inventory every service that touches EU personal data, then sign or accept each vendor's DPA and confirm SCCs are included. Most major vendors publish DPA acceptance flows in their account settings.
Cross-border transfer checklist:
1. Identify data flows: database region (Supabase → which region?),
email (SendGrid US?), analytics (GA4 → Google US servers)
2. For each service:
- Stripe DPA: stripe.com/legal/dpa (SCCs included)
- SendGrid DPA: sendgrid.com/policies/dpa
- Google (GA4): business.safety.google/adsprocessorterms
- Vercel DPA: vercel.com/legal/dpa
3. Accept each DPA via account settings or by emailing legal@vendor.com
4. Log in your data register: service, data shared, DPA date, transfer mechanism
5. Add to privacy policy: "We transfer data to [country] governed by SCCs
approved by the European Commission."
Alternatively, provision EU-region infrastructure (Supabase EU, AWS eu-west-1) to reduce the volume of transfers requiring documentation.
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the Data Protection Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- gdpr · Art. 46 — Transfers subject to appropriate safeguards
- gdpr · Art. 45 — Transfers on the basis of an adequacy decision
- gdpr · Art. 28 — Processor obligations including cross-border disclosure
- iso-27001:2022 · A.5.34 — Privacy and protection of PII
- gdpr · Art. 44 — General principle for transfers
Taxons
History
- 2026-04-18·v1.0.0·Initial import from data-protection·automated