Reference: https://www.isaca.org/resources/isaca-journal/past-issues/2014/data-ownersresponsibilities-when-migrating-to-the-cloud
Cross-border data transfer regulations are laws and rules that govern the movement of personal data
across national or regional boundaries. They aim to protect the privacy rights and interests of the
data subjects, and to ensure that their personal data are not subject to lower or incompatible
standards of protection in other jurisdictions. Examples of cross-border data transfer regulations
include the General Data Protection Regulation (GDPR) in the European Union, the California
Consumer Privacy Act (CCPA) in the United States, and the Personal Information Protection Law
(PIPL) in China.
When an organization uses a cloud service provider to store and process data, it may face the risk of
transferring personal data to a region with different data protection requirements, such as a region
that has not been recognized as providing adequate or equivalent levels of protection by the original
jurisdiction, or a region that has conflicting or incompatible laws or regulations with the original
jurisdiction. This may result in the following consequences for the organization:
It may violate the cross-border data transfer regulations of the original jurisdiction, and face legal
sanctions, fines, or lawsuits from the regulators, customers, or data subjects.
It may lose control or visibility over the personal data, and expose them to unauthorized or unlawful
access, use, modification, or disclosure by the cloud service provider or third parties.
It may compromise the trust and confidence of the customers and data subjects, and damage its
reputation and competitiveness.
Therefore, an organization subject to cross-border data transfer regulations should carefully assess
and manage the risks of using a cloud service provider to store and process data, and ensure that it
has appropriate safeguards and mechanisms in place to protect the privacy of personal data across
borders.
Reference:
Cross-Border Data Transfer and Data Localization Requirements … - ISACA, section 1: “As a result,
China’s National People’s Congress (NPC) and the National Committee of the Chinese People’s
Political Consultative Conference (PCC) put forward suggestions on legislation addressing cross-
border data transfer.”
Regulatory Approaches to Cross-Border Data Transfers, section 1: “Cross-border transfers of personal
information are increasingly common in today’s globalised economy. However, different jurisdictions
have different approaches to regulating such transfers.”
Cross-Border Data Transfer Requirements: Global Privacy Laws - Securiti, section 1: “Data transfer
conditions, mechanisms, localization and regulatory authority of each law.”
The Regulation of Cross-Border Data Transfers in the Context … - Springer, section 1: “No Party shall
prohibit or restrict the cross-border transfer of information, including personal information, by
electronic means if this activity is for the conduct of the business of a covered person.”
