6. Global Privacy Regimes and Cross-Border Data Transfers

Introduction and Context

Digital services rarely remain within one jurisdiction. A customer may live in India, use an application hosted in Singapore, receive support from personnel in the Philippines, and have payment or analytics services supplied from the United States. Personal data therefore moves through corporate groups, cloud environments, software-as-a-service platforms, logistics networks, advertising ecosystems, and public authorities. The legal question is not simply whether an organisation may collect data. It is also whether the organisation may lawfully disclose, access, store, analyse, or retrieve that data across national borders.

Cross-border privacy regulation is difficult because legal systems pursue overlapping but different objectives. Privacy laws protect individuals, while cybersecurity rules protect confidentiality, integrity, and availability. National-security and law-enforcement laws seek governmental access. Sectoral rules address health, finance, telecommunications, or children’s data. Data-localisation policies seek domestic control, economic development, or strategic autonomy. A multinational organisation must reconcile these objectives without assuming that compliance in one country satisfies all others.

The European Union’s General Data Protection Regulation (GDPR) is a central reference point because of its broad territorial scope and detailed rules for international transfers. It is not, however, a universal model. The United States relies mainly on sectoral federal statutes, state privacy laws, regulatory enforcement, and contractual or security requirements. Asia-Pacific jurisdictions combine comprehensive privacy statutes with localisation, consent, government-access, registration, or sector-specific requirements. The practical task is consequently one of legal mapping, risk assessment, governance, and technical design.

Learning Objectives

After studying this chapter, the learner should be able to:

1. Compare the GDPR with major United States, Asia-Pacific, and other national privacy regimes.

2. Explain adequacy decisions, standard contractual clauses, binding corporate rules, and other transfer mechanisms.

3. Distinguish privacy compliance from data localisation and information-security compliance.

4. Assess government-access risk and conduct a transfer impact assessment.

5. Design a multinational privacy and transfer-governance strategy.

6. Evaluate practical, ethical, organisational, and technical challenges in cross-border data use.

The Legal Architecture of Global Privacy

A privacy regime usually contains several interconnected elements. First, it defines protected information. Personal data under the GDPR is broadly understood as information relating to an identified or identifiable natural person. Other laws use terms such as personal information or personal data, sometimes excluding publicly available, de-identified, employee, or business-contact information.

Second, a regime identifies regulated actors. The GDPR distinguishes controllers, which determine purposes and means, from processors, which process data on behalf of controllers. Similar distinctions appear in other jurisdictions, although terminology and obligations differ. A cloud provider may be a processor for hosting, an independent controller for its own billing records, and a joint controller for a jointly operated service.

Third, the law specifies permitted purposes and legal bases. The GDPR recognises consent, contract, legal obligation, vital interests, public task, and legitimate interests, subject to conditions. Other jurisdictions may emphasise notice and consent, opt-out rights, reasonable purposes, or sectoral authorisation. The same business activity may therefore require consent in one jurisdiction, an opt-out mechanism in another, and a documented legitimate-interest assessment under the GDPR.

Fourth, privacy laws establish individual rights. These may include access, correction, deletion, portability, objection, restriction, appeal, and rights concerning automated decision-making. Finally, they regulate security, breach notification, accountability, retention, vendor management, government access, and international transfers.

Important Terminology

Personal data or personal information is information linked or reasonably linkable to an individual. Sensitive data receives enhanced protection because misuse may cause greater harm; examples include health, biometric, genetic, financial, or precise location information. Processing includes collection, storage, consultation, alteration, disclosure, analysis, and deletion.

A controller determines why and how data is processed. A processor acts on documented instructions. A data fiduciary, used in some legal systems, carries heightened responsibility for determining processing purposes and protecting individuals’ interests. Anonymisation irreversibly prevents reasonable re-identification, whereas pseudonymisation replaces identifiers but leaves re-identification possible through additional information.

A cross-border transfer is not limited to physically copying a database abroad. It may include remote access by overseas personnel, support access by a foreign vendor, cloud replication, disclosure to an overseas affiliate, or making data available to an entity subject to another jurisdiction. A data export is the transferor’s disclosure; an onward transfer is a recipient’s subsequent disclosure to another organisation or country.

Comparing Major Privacy Regimes

The European Union and the GDPR

The GDPR applies to organisations established in the European Economic Area and, in important circumstances, to organisations outside it that offer goods or services to individuals in the European Union or monitor their behaviour. It imposes principles of lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity, confidentiality, and accountability.

The GDPR provides extensive rights and requires appropriate technical and organisational measures. Controllers must select processors carefully, maintain records, respond to rights requests, report certain personal-data breaches to supervisory authorities within seventy-two hours of becoming aware, and conduct data protection impact assessments where processing is likely to create high risks. Data protection officers may be required, particularly for public bodies or organisations conducting large-scale monitoring or processing sensitive data.

The GDPR also regulates transfers to countries outside the EEA. A transfer may rely on an adequacy decision, an approved safeguard such as Standard Contractual Clauses (SCCs), Binding Corporate Rules (BCRs), an approved code or certification mechanism, or a limited derogation. Derogations are exceptions and should not become a routine substitute for a stable transfer mechanism.

The United States

The United States has no single comprehensive federal privacy law equivalent to the GDPR. Instead, the legal environment combines sectoral statutes, federal consumer-protection enforcement, state comprehensive privacy laws, breach-notification laws, financial rules, health rules, children’s protections, and contractual obligations.

The Federal Trade Commission may challenge unfair or deceptive privacy and security practices. The Health Insurance Portability and Accountability Act regulates protected health information handled by covered entities and business associates. The Gramm-Leach-Bliley Act addresses non-public personal information held by financial institutions. The Children’s Online Privacy Protection Act regulates online collection from children under thirteen. State laws, including California’s Consumer Privacy Act as amended by the California Privacy Rights Act, provide rights that may include access, deletion, correction, limitation of sensitive-data use, and opting out of sale, sharing, or certain profiling.

The United States model is therefore risk- and sector-sensitive. A multinational organisation must identify the role of federal agencies, state thresholds, sectoral definitions, contractual commitments, and data-specific restrictions. The absence of a single federal statute does not mean that data transfers are unregulated. It means that the compliance analysis is distributed across several sources.

Government access is a major consideration in transatlantic transfers. Under the EU–US Data Privacy Framework, participating US organisations may receive EU personal data under the framework’s conditions. Organisations that rely on it must verify active certification and comply with its obligations. Other transfer mechanisms may still be necessary, and an organisation must assess the actual processing, access pathways, onward transfers, and available remedies rather than treating certification as a universal answer.

Asia-Pacific Regimes

Asia-Pacific systems are diverse. Japan’s Act on the Protection of Personal Information (APPI) provides a comprehensive framework and regulates transfers to foreign third parties through mechanisms such as consent, recognised adequate protection, or safeguards required by the statute. Japan has been recognised by the European Union as providing adequate protection, subject to the relevant legal arrangement.

South Korea’s Personal Information Protection Act is comprehensive and detailed, with strong individual rights, security duties, regulatory oversight, and rules concerning overseas transfers. India’s Digital Personal Data Protection Act, 2023 establishes duties for data fiduciaries and rights for data principals, while permitting the government to restrict transfers to notified countries or territories. Its operational effect must be assessed alongside sectoral rules and implementing developments.

Singapore’s Personal Data Protection Act combines consent and accountability concepts with requirements concerning purpose, protection, retention, access, correction, breach notification, and transfer limitation. Organisations transferring personal data overseas must ensure a standard of protection comparable to that required in Singapore. Australia’s Privacy Act and Australian Privacy Principles regulate handling and overseas disclosure, with accountability potentially remaining with the Australian organisation after disclosure.

China’s Personal Information Protection Law (PIPL) is a comprehensive regime with extraterritorial reach in specified circumstances. Cross-border transfers may involve security assessments, certification, standard contracts, or other prescribed conditions depending on the circumstances, volume, data category, and organisational status. China also has cybersecurity and data-security rules that may impose important localisation, assessment, or export controls. The legal analysis cannot treat PIPL as an ordinary contractual privacy statute.

Other Influential Regimes

Brazil’s Lei Geral de Proteção de Dados (LGPD) resembles the GDPR in its principles, legal bases, rights, controller-processor concepts, security duties, and international-transfer controls. Canada’s private-sector rules, including the Personal Information Protection and Electronic Documents Act and provincial laws, emphasise accountability, meaningful consent, safeguards, and reasonable purposes; provincial public-sector and health regimes may also apply. South Africa’s Protection of Personal Information Act regulates processing, security safeguards, operator relationships, and transfers to foreign countries under specified conditions.

The important comparative lesson is that similarity of language does not guarantee equivalence of application. “Consent,” “sensitive data,” “sale,” “transfer,” “public authority,” and “adequate protection” may have materially different meanings. Compliance teams must compare operative requirements rather than rely on labels.

International Transfer Mechanisms and Decision-Making

Adequacy

An adequacy decision is a formal determination that a destination country, territory, sector, or international organisation provides an essentially equivalent level of protection for a specified legal regime. It simplifies transfers because the exporter need not negotiate a separate contract for every transfer. Adequacy is not a permanent guarantee; it may be limited, reviewed, or invalidated if legal conditions change.

Adequacy should also be distinguished from a business’s internal conclusion that a vendor is “adequate.” The former is a public legal mechanism; the latter is a risk judgement that may be insufficient without an approved safeguard.

Standard Contractual Clauses

SCCs are pre-approved contractual provisions imposing obligations on exporters and importers. They normally require transparency, security, assistance with rights requests, breach cooperation, deletion or return, audit-related support, and controls over onward transfers. Organisations must select the correct module, complete the parties and processing details, identify competent authorities, and maintain consistency with the actual relationship.

SCCs do not transform unlawful processing into lawful processing. They also do not eliminate the need to examine whether the importer can comply with the clauses in light of local surveillance, disclosure, or secrecy laws. Supplementary technical or organisational measures may be required.

Binding Corporate Rules and Other Tools

BCRs are internal rules approved for multinational groups. They are valuable for stable, repeated intra-group transfers, but approval requires substantial documentation, enforceable rights, accountability, complaint handling, and governance. They are resource-intensive and do not automatically solve transfers to independent vendors.

Other mechanisms include approved codes of conduct, certification systems, statutory exceptions, and consent-based derogations. Consent for a transfer must generally be specific, informed, explicit where required, and revocable; it is often unsuitable for routine structural transfers because refusal may not be genuinely free or because the transfer is repeated and difficult to explain.

Transfer Impact Assessments

A Transfer Impact Assessment (TIA) is a structured examination of whether a proposed transfer can operate with an essentially equivalent level of protection and what supplementary measures are needed. A sound TIA is not a generic questionnaire. It connects legal analysis with data flows, technical architecture, actual business operations, and documented evidence.

A practical TIA may proceed through the following stages:

1. Map the transfer. Identify data categories, individuals, purposes, exporter, importer, locations, remote-access routes, subprocessors, storage regions, backups, and onward transfers.

2. Classify the data and harm. Record sensitivity, volume, identifiability, vulnerability of individuals, and consequences of disclosure or misuse.

3. Identify the legal mechanism. Determine whether adequacy, SCCs, BCRs, certification, or another lawful basis applies.

4. Assess destination-country law and practice. Examine surveillance powers, law-enforcement access, judicial oversight, redress, secrecy obligations, and the likelihood of compelled disclosure.

5. Assess the importer. Consider its sector, ownership, technical access, history of requests, transparency, and ability to challenge unlawful demands.

6. Select supplementary measures. Consider encryption, customer-held keys, pseudonymisation, access controls, split processing, regional hosting, and strict support procedures.

7. Reach and document a decision. Proceed, modify, suspend, or prohibit the transfer; record assumptions and approvals.

8. Monitor. Reassess after legal changes, incidents, new subprocessors, material architecture changes, or government requests.

Encryption is strongest where keys remain under the exporter’s or customer’s exclusive control and the recipient cannot access plaintext. Encryption in transit and at rest may be insufficient if a foreign provider can decrypt data or is compelled to provide usable plaintext. Pseudonymisation reduces exposure but does not remove transfer obligations when re-identification remains possible.

A Multinational Compliance Strategy

A mature programme begins with a data inventory and a jurisdictional matrix. The matrix should connect each processing activity to data subjects, purposes, legal bases, retention, rights, transfer mechanism, vendor, storage location, and responsible owner. It should be maintained as an operational record, not produced only for an audit.

Organisations should then establish a baseline privacy standard, supplemented by local modules. A global baseline may require minimisation, defined retention, encryption, access logging, incident escalation, vendor due diligence, and rights-response procedures. Local modules can add consent language, registration, localisation, representative requirements, children’s rules, sensitive-data restrictions, or government-reporting duties.

Contract governance is central. Data-processing agreements should define roles, instructions, security measures, subprocessors, audit support, deletion, assistance with rights, incident notification, government requests, transfer mechanisms, and exit procedures. Procurement should not approve a cloud service until its data locations, support model, encryption design, and onward-transfer chain are understood.

Technology architecture can reduce legal exposure. Regional storage, data-tokenisation, privacy-enhancing computation, confidential computing, role-based access, zero-trust principles, customer-managed keys, and automated retention controls help align actual processing with legal commitments. Automation can discover personal data, identify unexpected international access, monitor retention, and route rights requests. However, automated classification produces false positives and false negatives; human review remains necessary for high-risk decisions.

Governance should assign accountability to senior management, privacy professionals, security leaders, procurement, legal teams, engineering, and business owners. Metrics may include the percentage of processing activities with documented transfer mechanisms, time to complete TIAs, unresolved vendor exceptions, rights-response performance, unauthorised cross-border access events, and the proportion of sensitive data protected by customer-controlled encryption.

Illustrative Case Study: Global Health Analytics Platform

Background

MedData Cloud, a fictional multinational provider, operates a health-analytics platform for hospitals in Germany, Singapore, Australia, India, and Canada. Primary data is stored in European and Asia-Pacific regions. A US-based parent company provides threat monitoring and engineering support. Support personnel in the United States and the Philippines may access pseudonymised records. A third-party analytics provider proposes to process identifiable data in the United States.

Situation and Problem

A hospital consortium asks whether the arrangement complies with the GDPR and local laws. The company initially argues that data is “stored locally” and that pseudonymisation means no transfer occurs. A security review finds that support engineers can access re-identification keys during troubleshooting and that the analytics provider uses a subprocessors’ environment whose location is not contractually fixed.

Analysis

The company has several transfers, not one: European data is remotely accessible from the United States and the Philippines; Singaporean and Australian data is disclosed to foreign processors; and the proposed analytics service creates an onward-transfer chain. Pseudonymisation reduces risk but does not eliminate personal-data status. The company must identify controller and processor roles, document purposes and legal bases, and assess each destination’s government-access risks.

For EU data, an applicable adequacy route may be available for a certified US recipient, but certification must be verified and its scope must match the service. Otherwise, SCCs and a TIA are required. The TIA should examine the provider’s ability to access plaintext, legal obligations, transparency, challenge procedures, and technical controls. Singapore and Australia require their own transfer analysis, and China or other jurisdictions would require additional country-specific assessment if their data were included.

Strategy and Solution

MedData Cloud separates identifiable clinical records from analytics datasets. It keeps re-identification keys with the hospital, uses customer-managed encryption keys, removes routine US access to plaintext, and permits support through monitored, time-limited access. The analytics provider receives only tokenised data and is prohibited from using it for independent purposes. The company replaces the uncontrolled subprocessor with a contractually identified provider, adds onward-transfer approval, conducts TIAs, updates privacy notices, and creates a government-request escalation process.

Outcome

The revised design does not eliminate all legal risk, but it materially reduces unnecessary access and makes the transfer mechanisms, data roles, and technical protections demonstrable. The hospital consortium receives an auditable data-flow map, contractual package, TIA summary, and incident-response commitments.

Learning Points

Local storage is not the same as local processing. Remote administrative access may be a transfer. Pseudonymisation is a safeguard, not an automatic exemption. Transfer compliance requires legal, contractual, organisational, and technical measures working together.

Challenges, Ethical Issues, and Common Errors

The most frequent error is treating a signed contract as the entire transfer analysis. Contracts cannot prevent a provider from being legally compelled to disclose data if the organisation has not assessed technical access and available remedies. A second error is using consent as a universal solution. Consent may be invalid where individuals lack a meaningful choice, and it does not remove security or minimisation duties.

A third error is confusing localisation with privacy. Keeping servers in a country may reduce foreign access but may also increase domestic government-access risk, cost, duplication, and operational fragility. Conversely, international cloud processing may be lawful if appropriate safeguards exist. The correct decision depends on data, purpose, architecture, and applicable law.

Ethically, organisations should avoid exploiting legal differences to place vulnerable individuals in jurisdictions with weaker remedies. They should be transparent about meaningful access risks, avoid excessive collection merely because technology permits it, and ensure that localisation decisions do not deny individuals essential services. Government requests should be handled lawfully, challenged where appropriate, narrowly interpreted, and disclosed to affected parties when legally permitted.

A further limitation is uncertainty. Laws, regulatory guidance, court decisions, adequacy arrangements, and government practices change. A TIA is therefore a living governance instrument, not a one-time certificate of safety. Legal conclusions should identify assumptions, confidence levels, unresolved questions, and escalation triggers.

Current Developments and Emerging Practice

Privacy regulation is moving toward greater accountability, stronger protection for sensitive and children’s data, scrutiny of targeted advertising and automated decision-making, and more formal controls on high-risk international transfers. Regulatory attention is increasingly directed to cloud concentration, remote support access, software supply chains, and the practical effectiveness of encryption.

Artificial intelligence intensifies the problem. Training datasets may combine information from many jurisdictions, models may be hosted or supported internationally, and prompts or telemetry may expose personal data to vendors. Organisations should establish data-use restrictions, retention controls, vendor prohibitions on training, regional processing options, testing for memorisation, and human review for high-impact outputs. AI governance does not replace privacy compliance; it makes data mapping, purpose limitation, minimisation, and transfer assessment more important.

Best-Practice Checklist

An organisation seeking a defensible global programme should:

• maintain an accurate data-flow and transfer inventory;
• classify data by sensitivity, jurisdiction, and harm;
• identify controllers, processors, affiliates, and subprocessors;
• select a lawful transfer mechanism for every relevant route;
• conduct and periodically refresh TIAs;
• use encryption and key-management designs that limit foreign access;
• control remote administration and record privileged access;
• impose onward-transfer and subprocessor restrictions;
• align notices, contracts, retention, and actual architecture;
• test rights, breach, deletion, and government-request procedures;
• monitor legal changes and vendor certifications; and
• obtain senior approval for high-risk exceptions.

Chapter Summary

Global privacy compliance is a problem of legal plurality, data movement, and operational accountability. The GDPR offers a detailed, rights-based framework with adequacy decisions, SCCs, BCRs, and limited derogations for international transfers. The United States uses a distributed model involving federal enforcement, sectoral laws, state statutes, and contractual obligations. Asia-Pacific and other regimes vary widely in consent, accountability, localisation, government access, and export requirements.

A lawful transfer requires more than selecting a contract. Organisations must map data, identify roles and purposes, assess destination-country law and practice, evaluate government-access risk, apply supplementary measures, and monitor changes. Localisation, pseudonymisation, certification, and consent are tools with limits rather than universal solutions. Effective multinational strategy combines privacy governance, procurement, legal analysis, secure architecture, vendor management, and ethical judgement.

Key Terms

Adequacy decision: Official recognition that a destination provides an essentially equivalent level of protection.

Binding Corporate Rules: Approved internal privacy rules governing transfers within a multinational group.

Controller: Organisation that determines the purposes and means of processing.

Cross-border transfer: Making personal data accessible, disclosing it, or moving it across jurisdictions.

Data localisation: Requirement or policy favouring storage or processing within a specified country.

Data minimisation: Limiting collection and use to what is necessary for a stated purpose.

Data processor: Entity processing personal data on behalf of a controller.

Derogation: Limited legal exception to an ordinary transfer mechanism.

Government access: Access to data by law-enforcement, intelligence, or other public authorities.

Pseudonymisation: Replacing identifiers while retaining a means of re-identification.

Sensitive data: Data requiring enhanced protection because misuse may cause serious harm.

Standard Contractual Clauses: Pre-approved contractual safeguards for specified international transfers.

Supplementary measures: Technical, organisational, or contractual protections added to a transfer mechanism.

Transfer Impact Assessment: Documented evaluation of transfer risks, destination law, and safeguards.

Onward transfer: Subsequent disclosure by an initial recipient to another entity or jurisdiction.

Privacy by design: Integrating privacy protections into systems and processes from the outset.

Purpose limitation: Using data only for specified, explicit, and compatible purposes.

Data fiduciary: Actor bearing defined responsibility for determining and responsibly managing personal-data processing.

Review Questions

Short Answer Questions

1. Why is local data storage not necessarily equivalent to local processing?

2. Distinguish an adequacy decision from a Transfer Impact Assessment.

3. What is the difference between a controller and a processor?

4. Why does pseudonymisation not automatically remove transfer obligations?

5. Identify two supplementary measures that may reduce government-access risk.

Long Answer Questions

1. Compare the GDPR, United States privacy model, and one Asia-Pacific regime in relation to rights, enforcement, and international transfers.

2. Explain the principal transfer mechanisms available under the GDPR and evaluate their practical strengths and limitations.

3. Describe a complete Transfer Impact Assessment process for a cloud service.

4. Analyse how a multinational organisation should combine global privacy standards with local legal modules.

5. Discuss the relationship between privacy law, cybersecurity, data localisation, and government access.

Analytical / Application Questions

1. A European company uses a US cloud provider whose support team can remotely access encrypted databases. Design the questions and safeguards required before approving the transfer.

2. A company claims that obtaining employee consent solves all international-transfer issues. Critically assess the claim using legal, ethical, and operational considerations.

3. Using the MedData Cloud case, identify the transfer routes, weaknesses in the original design, and three improvements that should be prioritised.

22. Multiple Choice Questions with Answers

Question 1

Which statement best describes an adequacy decision?

A. A private contract confirming that a vendor follows internal policy

B. An official recognition that a destination provides an essentially equivalent level of protection

C. A requirement that all data be stored on domestic servers

D. A risk assessment performed only after a data breach

Correct Answer: B. An official recognition that a destination provides an essentially equivalent level of protection

Question 2

Why may remote access by overseas support staff constitute a cross-border transfer?

A. Because only physical database relocation counts as processing

B. Because making personal data accessible from another jurisdiction can amount to a transfer

C. Because support staff are always independent controllers

D. Because encryption automatically makes access unlawful

Correct Answer: B. Because making personal data accessible from another jurisdiction can amount to a transfer

Question 3

What is the principal purpose of a Transfer Impact Assessment?

A. To calculate the financial value of personal data

B. To determine whether a destination country has lower labour costs

C. To assess destination-country risks and the effectiveness of safeguards for a proposed transfer

D. To replace all contractual transfer mechanisms

Correct Answer: C. To assess destination-country risks and the effectiveness of safeguards for a proposed transfer

Question 4

Which is a limitation of pseudonymisation?

A. It always makes data publicly identifiable

B. It prevents encryption from being used

C. It may still be personal data when re-identification remains possible

D. It is permitted only for financial information

Correct Answer: C. It may still be personal data when re-identification remains possible

Question 5

Which feature most accurately characterises the United States privacy environment described in the chapter?

A. A single comprehensive federal statute identical to the GDPR

B. A combination of sectoral laws, federal enforcement, state laws, and contractual duties

C. Complete absence of privacy regulation

D. Exclusive reliance on data localisation

Correct Answer: B. A combination of sectoral laws, federal enforcement, state laws, and contractual duties

Question 6

A multinational group needs a stable mechanism for repeated transfers among its own entities. Which tool is specifically designed for this purpose?

A. Binding Corporate Rules

B. A one-time verbal consent

C. A breach-notification form

D. A storage-capacity report

Correct Answer: A. Binding Corporate Rules

Question 7

Which technical measure generally provides stronger protection against compelled plaintext disclosure by a cloud provider?

A. Publishing the database location

B. Customer-controlled encryption keys that the provider cannot access

C. Increasing the retention period

D. Removing access logs

Correct Answer: B. Customer-controlled encryption keys that the provider cannot access

Question 8

Why is consent often unsuitable as the routine solution for multinational transfers?

A. Consent can never be withdrawn

B. Consent may not be freely given and may be impractical for repeated structural transfers

C. Consent eliminates all security obligations

D. Consent applies only to anonymised data

Correct Answer: B. Consent may not be freely given and may be impractical for repeated structural transfers

Question 9

In the illustrative MedData case, what was a central weakness in the original design?

A. All data was irreversibly anonymised before collection

B. Support engineers could access re-identification keys and the subprocessor chain was unclear

C. The company used customer-managed encryption keys from the beginning

D. No data crossed any national border

Correct Answer: B. Support engineers could access re-identification keys and the subprocessor chain was unclear

Question 10

Which statement best distinguishes localisation from privacy compliance?

A. Localisation always guarantees stronger privacy

B. Localisation concerns where data is stored or processed, while privacy compliance includes broader duties and safeguards

C. Privacy compliance requires all data to remain domestic

D. Localisation eliminates government-access risk

Correct Answer: B. Localisation concerns where data is stored or processed, while privacy compliance includes broader duties and safeguards