Cross-border data transfer
Personal data crossing a legal border, including a US vendor merely viewing an EU record. EU law needs a mechanism in place before it moves.
See it
What it is
GDPR Chapter V lets personal data leave the EEA only with a transfer mechanism attached. Easy case: the destination has an adequacy decision (the UK, Switzerland, Japan, Canada for commercial organizations, and US companies certified under the EU-U.S. Data Privacy Framework), and you transfer as if it were domestic. Otherwise you need an Article 46 safeguard. Standard Contractual Clauses are the common one, but they are not the only one: Binding Corporate Rules cover intra-group transfers, and approved codes of conduct and certification schemes also qualify. Article 49 adds a short list of derogations (explicit informed consent, transfers necessary to perform a contract) that regulators read narrowly and dislike as a standing arrangement. Whichever route you take, a documented transfer impact assessment travels with it.
Transfer is broader than copying a database. Remote access counts: if a support engineer in Bangalore can pull an EU customer record onto a screen, that is a transfer. So is a US-headquartered cloud provider whose staff can reach into EU-region infrastructure. That is why serious subprocessor lists name the countries the personnel sit in, not just the region the servers sit in.
The gotcha is confusing this with data residency. Pinning the database to an EU region is a great procurement story, but it does not by itself solve a transfer problem when a non-EU parent can access that region, and residency is usually a promise you sold, not a legal requirement. Work out which of the two your customer is actually asking about before you re-architect anything.
Ask AI for it
Map the cross-border personal data flows for this product and output a transfer register table: one row per third-party vendor or internal system, with data categories, storage region, the countries where personnel can access the data, and the transfer mechanism relied on (adequacy decision, EU-U.S. Data Privacy Framework certification, Standard Contractual Clauses with the module named, Binding Corporate Rules, an Article 49 derogation, or none). Flag every flow with no mechanism as a gap. Then draft a short transfer impact assessment for the riskiest US vendor. Ground it in two things only: dated official legal sources for the destination country's access regime, cited individually, and the vendor's own documented facts (its technical and organizational measures, the countries its personnel can access data from, who holds the encryption keys, and its published government-request policy). Where a source or a vendor fact is missing, write a bracketed TODO naming exactly what to obtain. Do not infer surveillance-law conclusions from general knowledge, and do not invent vendor controls. Close with a residual risk conclusion that states which of its inputs are confirmed and which are still TODOs.