Cross-Border Data Transfers: A Founder’s Compliance Guide

A cross-border data transfer happens when personal data moves, or can be accessed, from one country in a place where the law restricts that movement. For a startup, the two regimes that bite first are the EU’s GDPR, which limits transfers out of the European Economic Area (EEA), and the US Department of Justice’s Data Security Program, which limits certain transfers of sensitive US data to countries of concern. Each asks a different question. GDPR asks whether the data stays protected after it leaves. The DOJ rule asks who ends up with access to it.

This guide walks through both, in the order a founder meets them: map the data, pick a legal transfer tool, test it, document it, and keep it current.

TL;DR

• Under GDPR, personal data can leave the EEA only through an adequacy decision, appropriate safeguards such as Standard Contractual Clauses (SCCs) or Binding Corporate Rules, or a narrow exception that cannot be your default.
• Signing SCCs is not the finish line. The EDPB expects you to assess whether the destination country’s laws, especially on surveillance, undermine them, and to document that assessment.
• In the US, the DOJ Data Security Program restricts bulk sensitive personal data transactions with countries of concern. Thresholds start as low as 100 people for human genomic data.
• Start by mapping every flow: what data, which systems, which vendors, which countries, who can access it.

Table of Contents

• What counts as a cross-border transfer
• Step one: map your data flows
• Step two: choose a GDPR transfer mechanism
• Step three: the transfer impact assessment
• The US side: DOJ rules on bulk sensitive data
• A worked example
• Our perspective: compliance is a sales asset
• How we help founders cross the border
• Common mistakes
• FAQ
• Sources

What counts as a cross-border transfer

Most founders picture a transfer as an export of a database. In practice it is broader. Hosting customer data in a region outside the customer’s home jurisdiction counts. So does a support engineer in another country who can view a customer record, a sub-processor that runs analytics abroad, or a parent company that pulls HR data into a group system.

The European Commission’s rules on international transfers apply to transfers of personal data outside the EEA, which covers the EU countries plus Iceland, Liechtenstein and Norway. The EDPB’s guide for small businesses makes the same point from the SME angle: transfers are often essential to trade and cooperation, and a small company may well need to make them.

There is no single global rulebook. The OECD describes a patchwork of unilateral safeguards, plurilateral arrangements such as APEC’s CBPR, and trade-based agreements, and warns about compliance fatigue for global businesses. Expect to satisfy more than one regime at once.

Step one: map your data flows

The EDPB’s recommendations on supplementary measures start with a simple instruction: know your transfers. You cannot protect data you have not located. A workable map answers six questions for each flow:

1. What categories of personal data move (customer contacts, employee records, telemetry, logs, health or biometric data)?
2. Where does it originate, and under which law?
3. Where is it stored, and where can it be accessed from?
4. Which vendors and sub-processors touch it?
5. What is the purpose, and could you achieve it with less data or with pseudonymized data?
6. Which transfer tool covers it today, if any?

A spreadsheet is enough for a seed-stage company. The discipline matters more than the tooling. If your team is small and you are building a wider privacy program, GDPR compliance planning for small teams shows how the same mapping logic applies to a data-heavy function like hiring, where candidate data often crosses borders without anyone noticing.

For a SaaS-focused version of the whole program, see our own GDPR plan for SaaS startups.

Step two: choose a GDPR transfer mechanism

The Commission lists three routes. They are ranked in practice by how much work they save you.

The Commission’s own wording is that derogations are for exceptional, specific scenarios. If your product sends customer data to a US cloud every day, a derogation is not your answer.

Adequacy and the EU-US Data Privacy Framework

For US companies receiving EU data, the most convenient route is the EU-US Data Privacy Framework. US companies can self-certify to the framework’s principles through the Commerce Department’s program website, and EU exporters can then rely on adequacy for transfers to certified recipients.

Two cautions for founders. First, the framework only helps if the specific recipient is certified and its certification covers the data type you send. Check the public list before you rely on it. Second, its durability has been contested. The EU General Court dismissed a challenge in September 2025, and an appeal was lodged on 31 October 2025 (Case C-703/25 P). Check the current status before you finalize your architecture. Many companies layer SCCs under the framework as a fallback, so a future ruling does not leave them with no legal basis overnight. Ask your counsel whether that fits your situation.

Standard Contractual Clauses

SCCs are the workhorse for startups. They are pre-approved model clauses, and using them is voluntary, but once they are in your contract they become a binding commitment. The Commission published the modernized set on 4 June 2021, replacing the 2010 versions.

The Commission’s questions and answers on the new SCCs explain that it adopted two sets: one for controller-to-processor relationships inside the EEA, and one for transfers to non-EEA countries. The transfer set uses modules, so you select the one matching the roles of exporter and importer:

• Controller to controller
• Controller to processor
• Processor to processor
• Processor to controller

A common founder error is to attach the whole text without choosing a module, or to leave the annexes blank. The annexes are where you describe the data, purposes, security measures and sub-processors. Blank annexes make the clauses hard to defend.

Binding Corporate Rules

Binding Corporate Rules suit multinational groups moving data between their own entities. They require regulatory approval and significant time, so they are rarely the right tool for a seed-stage company. Know they exist, and revisit them if you grow into several subsidiaries.

Step three: the transfer impact assessment

This is the part that surprises founders who thought a signed contract was enough. The EDPB’s recommendations, written after the Court of Justice’s Schrems II judgment, say that under the accountability principle you must verify and document whether the third country’s law lets the importer honor the contractual safeguards in practice, particularly around government access and surveillance. That documented analysis is the transfer impact assessment (TIA).

A practical TIA covers:

• The transfer itself: the data, the parties, the purpose, the onward transfers.
• The tool relied on: SCC module, BCRs or another route.
• The destination’s law and practice: which authorities can compel access, under what conditions, with what oversight and redress.
• Your specific facts: is the data of a kind that intelligence or law enforcement would plausibly seek? Has the importer ever received such a request?
• Supplementary measures: technical, organizational or contractual steps that close the gaps.
• The conclusion and a review date.

The EDPB is explicit about the outcome. When local law undermines the safeguards, you must either apply supplementary measures that work or, if none exists, suspend or end the transfer. It also treats the assessment as continuous rather than one-time, so calendar a review when your vendors, data types or the destination’s laws change.

Supplementary measures that tend to matter

For a security or AI startup, technical measures are often your strongest card:

• Encryption with keys held in the EEA or by the customer, so the importer cannot read the data in the clear.
• Pseudonymization, with the re-identification key kept separate and out of the destination country.
• Data minimization, sending only the fields the importer needs.
• Regional hosting, so EU customer data stays in an EU region and only metadata or support access crosses the border.
• Contractual commitments to challenge overbroad government requests and to notify the exporter where lawful.

Measures should match the threat. Encryption that the importer can undo at will does little against a compulsion order. Say so in your TIA rather than overclaiming.

The US side: DOJ rules on bulk sensitive data

If your company is American, or you are expanding into the US, cross-border data transfer is no longer only a GDPR topic. The DOJ’s Data Security Program addresses national-security risks from foreign adversaries exploiting commercial activity to reach Americans’ bulk sensitive personal data and US government-related data. It works more like export control than privacy law, and it restricts specific data transactions with specific countries and persons.

The DOJ’s FAQs state that the program does not prohibit all data transactions with all foreign persons or countries. It governs covered data transactions with, or involving access by, covered persons or countries of concern. According to the DOJ’s FAQ document, the bulk thresholds include:

Countries of concern named in the same material include China (with Hong Kong and Macau), Russia, Iran, North Korea, Cuba and Venezuela. The DOJ materials also cover other categories, such as precise geolocation data for 1,000 or more devices.

What this means for a startup:

• Check your vendors and investors. The program covers access, not just shipping a file. A contractor, subsidiary or data broker in a country of concern, or a covered person, can trigger it.
• Know your volumes. A health-adjacent or biometric product can cross a threshold with a small user base.
• Build a compliance program before you need it. Because the rule treats data deals somewhat like controlled exports, you will want data-level mapping and vendor diligence in place before expansion. Have US counsel confirm how the rule applies to your product.

Our US compliance checklist for foreign cybersecurity startups places this next to the other requirements a company meets when it lands in the US. If you are also an EU-regulated vendor, the NIS2 and US compliance guide for security vendors covers the overlap.

A worked example

Take a hypothetical German endpoint-security startup with its first US customers, and a US-based support team it plans to hire. This is an illustration, not a real company.

1. Map. Telemetry from EU customers includes device names and user names, which are personal data. The US support team needs to view these when debugging.
2. Pick the tool. The US entity is not framework-certified yet, so the group signs the controller-to-processor or processor-to-processor SCC module, depending on roles, between the German parent and the US subsidiary.
3. Assess. The TIA notes the US legal framework, the type of data (low sensitivity, technical identifiers) and the likelihood of government interest. It records that logs are pseudonymized before leaving the EU.
4. Add measures. Support staff see only pseudonymized IDs by default, and unmasking requires a logged, approved ticket. Keys remain in an EU region.
5. Check the US side. The company reviews its vendors and staff for any covered-person or country-of-concern access, and confirms it is below any bulk threshold or otherwise outside the rule.
6. Document and review. Everything goes in a transfer register with a review date and a trigger list: new sub-processor, new data category, new law.

This is a day or two of structured work for a small team when done early, versus a scramble when a large customer’s security questionnaire arrives.

Our perspective: compliance is a sales asset

We work with cybersecurity and AI founders, and the pattern repeats. Founders treat data-transfer paperwork as a legal tax. Their buyers treat it as evidence of how seriously the company handles data.

Cybertech Acceleration is the only US accelerator dedicated exclusively to digital forensics, and that focus shapes how we see this topic. A forensic mindset asks what you can prove, to whom, and in what form. A transfer register, a dated TIA and a vendor access log are exactly that kind of proof. When a European enterprise or a US regulator asks where your data went and who touched it, a company that can answer with records closes deals faster than one that answers with assurances.

The second thing we see is direction. Founders come to us for two-way market entry, US companies heading into Europe and European or other international companies heading into the US, and each direction inherits the other’s rules. A US company entering Europe meets GDPR transfer law. A European company entering the US meets state privacy regimes and the DOJ program. Planning for both from day one is cheaper than retrofitting.

Our advice: treat your data map as a product asset, write your TIA in plain business language, and keep the evidence trail clean enough to survive a hostile reader.

— Thiago Vieira

How we help founders cross the border

If you are a cybersecurity or AI startup preparing to sell on the other side of the Atlantic, data-transfer questions will come up in your first enterprise deals. Our Soft Landing program supports structured market entry, compliance and local setup, and introductions to potential partners, with the forensic and evidence-grade angle that makes your security story credible to buyers. For companies targeting Texas specifically, see the Cybertech Texas Mission. For market-specific entry guides, start with our cybersecurity startup guide to US market entry.

Common mistakes

• Relying on a derogation as a routine tool. It is for exceptional cases.
• Signing SCCs and skipping the TIA. The EDPB expects both.
• Ignoring remote access. Viewing data from another country is a transfer.
• Forgetting sub-processors. Onward transfers need coverage too.
• Treating the paperwork as one-time. Laws, vendors and data types change.
• Ignoring the US rules. Domestic companies are subject to the DOJ program as well.

FAQ

Do I need SCCs if my US vendor is certified under the Data Privacy Framework?

Not strictly, if the certification covers the data you send and the framework remains valid, because adequacy is a sufficient route. Many companies still add SCCs as a fallback given the pending appeal. Confirm the vendor’s certification on the public list before relying on it.

What is a transfer impact assessment?

It is a documented analysis of whether the destination country’s laws and practices, especially on government access, let the importer honor the safeguards in your transfer tool. The EDPB’s recommendations describe the process and expect it to be revisited over time. If the assessment shows a gap, you need supplementary measures or you must stop the transfer.

Is a cross-border transfer only about sending files?

No. Remote access from another country, hosting abroad and sub-processors that handle data elsewhere can all count. Map access as carefully as storage.

Does the US restrict data transfers at all?

Yes, in a targeted way. The DOJ Data Security Program restricts certain transactions in bulk sensitive personal data and government-related data involving countries of concern and covered persons. It is not a general ban on sending data abroad.

Sources

• European Commission’s rules on international transfers
• EDPB’s guide for small businesses
• a patchwork of unilateral safeguards, plurilateral arrangements such as APEC’s CBPR, and trade-based agreements
• know your transfers
• self-certify to the framework’s principles through the Commerce Department’s program website
• an appeal was lodged on 31 October 2025 (Case C-703/25 P)
• using them is voluntary, but once they are in your contract they become a binding commitment
• questions and answers on the new SCCs
• national-security risks from foreign adversaries exploiting commercial activity to reach Americans’ bulk sensitive personal data and US government-related data
• not prohibit all data transactions with all foreign persons or countries
• DOJ’s FAQ document

Recommended

• GDPR for SaaS Startups: A Practical Compliance Plan