Cross-border data transfer: which mechanism applies by origin country

What is cross-border data transfer when you deliver a dataset?#

Cross-border data transfer is the act of making personal data available to a recipient outside the jurisdiction whose privacy law governs it. When a company licenses a dataset to an AI developer, the delivery itself is usually the transfer: the moment the buyer's team in another country can open the files, the origin country's transfer rules apply.

Transfer rules attach to where the data comes from and which law covers it, not to where the seller's headquarters sits. A U.S. company holding Zendesk tickets from French customers, or a Canadian subsidiary's HubSpot contacts, can carry the origin country's rules into the deal.

A transfer mechanism answers one narrow question: may this personal data lawfully leave the origin jurisdiction for this recipient. It does not answer whether you own the records, whether your customer contracts allow reuse, or whether the people in the records agreed to this purpose. Those are separate checks, and a signed transfer clause does not create a right to license. The full framework of access, privacy permission, ownership and contracts is in our guide on the right to license business records.

Which four facts decide the mechanism before you open the matrix?#

Answer these four questions in order. Most suppliers find that one of the first two removes the transfer question entirely, or narrows it to one jurisdiction.

• 1Is the delivery still personal data? Records that are truly anonymized fall outside most privacy transfer rules, while pseudonymized records usually stay inside them. The U.S. DOJ rule is the exception: it applies even to de-identified or encrypted data above its thresholds.
• 2Whose law governs the people in the records? Map each source system (Salesforce, Zendesk, NetSuite, ServiceTitan) to where the people in it live and which entity collected them. One dataset can carry EU, UK and Canadian rows that need different mechanisms.
• 3What role will the buyer play? An AI developer training its own model on licensed data typically decides its own purposes, which usually makes it a controller (or the local equivalent), not a processor acting on your instructions. The role decides which clause set or legal test applies.
• 4Where will the buyer actually receive and process the data, and is the buyer itself covered by the origin law? A buyer's cloud region, parent company and offshore annotation vendors all count as destinations.

Which cross-border data transfer mechanism applies from the EU and UK?#

From the EU and UK, check adequacy first, then fall back to approved standard clauses. The European Commission's adequacy list and the UK's adequacy regulations (which the ICO also calls data bridges) let data flow without further safeguards; everywhere else, the EU 2021 SCCs or the UK IDTA or Addendum apply.

The Commission's list includes Andorra, Argentina, Brazil, Canada (commercial organisations), the Faroe Islands, Guernsey, Israel, the Isle of Man, Japan, Jersey, New Zealand, the Republic of Korea, Switzerland, the United Kingdom, Uruguay and the United States for commercial organisations participating in the EU-US Data Privacy Framework. The EU's Brazil decision was adopted in January 2026 as part of a mutual arrangement.

Two details trip up suppliers. The 2021 SCCs are not meant for an importer that is already subject to the GDPR, and if you change their text beyond choosing modules and completing annexes they stop working as a transfer tool. On the UK side, the EU SCCs are not valid on their own; they work only with the ICO's Addendum, and either UK tool still needs a transfer risk assessment.

Which mechanism applies from Canada, Brazil, India, Singapore and the U.S.?#

Outside Europe, each regime uses a different tool, and Brazil's regulator publishes standard clauses that must be adopted unchanged. The table lists only mechanisms confirmed on each regulator's own site; anything the regulator did not state is left out rather than guessed.

Canada needs the most care. The privacy commissioner's 2009 guidance says PIPEDA does not prohibit sending personal information abroad for processing, provided the organization stays accountable, uses contractual or other means to give comparable protection, and tells people their information may be processed in another country. That guidance is about processors, and the commissioner's later transborder consultation took a different view on consent, so check current guidance. General guidance from us, not a statement on the commissioner's page: a licensee training its own model is generally not processing on your behalf, so a Canadian license may turn on consent for a new disclosure, which counsel should assess.

Does the U.S. restrict sending a licensed dataset abroad?#

Yes, for bulk sensitive data. The Justice Department's rule at 28 CFR part 202 treats licensing access to data as data brokerage, and it prohibits that brokerage with China (including Hong Kong and Macau), Cuba, Iran, North Korea, Russia and Venezuela and with covered persons tied to them.

The rule bites only above bulk thresholds counted over the preceding 12 months, such as personal health or financial data on more than 10,000 U.S. persons or covered personal identifiers on more than 100,000. Unlike most privacy laws, it counts data whether or not it is anonymized, pseudonymized, de-identified or encrypted.

For every other foreign buyer, the rule requires the license to bar onward transfer to a country of concern or covered person and requires you to report known or suspected violations. The existing SourceX guides on the DOJ rule cover thresholds and buyer screening in depth; this page only places it in the matrix.

Does de-identifying the dataset remove the transfer question?#

Sometimes, but never across the board. Under GDPR-style laws, data that is truly anonymized is outside the transfer rules, while pseudonymized data (tokens replacing names, hashed emails, stable customer IDs) usually is not. The test is whether people can still be identified by means reasonably likely to be used, and counsel makes that call on the actual delivery.

The U.S. DOJ rule works the other way: de-identification does not take bulk sensitive data out of scope. So a de-identified dataset of U.S. patient records can be outside HIPAA-style privacy concerns and still be barred from a buyer in a country of concern.

De-identification also does nothing for ownership or contract rights. If a customer agreement restricts reuse of their records, removing names does not lift that restriction.

What should the license say about cross-border transfers?#

The license should name the transfer basis and stop the data from moving somewhere the basis does not cover. These clauses are a practical checklist for counsel; the wording is theirs to set.

• 1Receiving entity and country: name the legal entity that receives the delivery and the countries where it may store or process it, including cloud regions.
• 2Transfer basis by origin: state which mechanism covers each origin slice (for example, EU rows under SCC module 1, UK rows under the IDTA, Brazil rows under the ANPD clauses).
• 3Onward transfer: limit sublicensing, affiliates and vendors (annotation contractors, cloud providers) to destinations covered by the same basis, and add the DOJ onward transfer bar where U.S. bulk sensitive data is involved.
• 4Re-identification ban: prohibit attempts to re-identify people in a de-identified delivery, which also supports the anonymization assessment.
• 5Change of circumstances: require notice if the buyer is acquired, moves processing, loses a Data Privacy Framework listing or becomes a covered person.
• 6Return or deletion: say what happens to the data if the transfer basis falls away.

Which origin countries does this matrix leave out?#

Saudi Arabia, Mexico and China as origin countries are not in the matrix because their transfer mechanisms were not confirmed on the regulator's own site for this page. Rather than guess at a row, this page leaves them to counsel and to the jurisdiction pages in the SourceX laws hub, which summarize each country's law without repeating it here.

The same applies to provinces and sector rules. Quebec, U.S. state laws and Indian sector regulators can add requirements on top of the national mechanism in the table.

How does this apply when you license data through SourceX?#

SourceX runs rights review, contracting, data preparation and delivery for companies licensing operational data to AI developers, and it works with U.S., Canadian and EU companies that had 50 or more full-time employees at their peak. Where records include people from another jurisdiction, the transfer basis is part of the deal review with your counsel.

Your company approves exactly what is released, once per deal, and sees what would leave the company before anything is shared. De-identification is performed by SourceX directly or through its processing partner, which helps with the anonymization question but, as above, does not settle every transfer rule. The first step is a short company assessment with no data uploads.