<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: detecting-cross-border-data-transfers
description: >-
  Detect, map, and validate cross-border personal data transfers under GDPR
  Chapter V (Articles 44-49), assess adequacy decisions, SCCs, BCRs, and
  identify unauthorized transfers across cloud infrastructure and third parties.
domain: cybersecurity
subdomain: privacy-engineering
tags:
  - cross-border
  - data-transfers
  - gdpr
  - schrems-ii
  - sccs
  - bcrs
  - adequacy
  - chapter-v
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1048"]
---

# Detecting Cross-Border Data Transfers

## Overview

Cross-border data transfers occur when personal data moves outside the EEA to third
countries. Under GDPR Chapter V (Articles 44–49), such transfers require appropriate
safeguards — adequacy decisions, Standard Contractual Clauses (SCCs), Binding Corporate
Rules (BCRs), or specific derogations. This skill covers detecting transfer points in
infrastructure, mapping data flows to geographic endpoints, validating transfer
mechanisms, and identifying unauthorized transfers post-Schrems II.

Mode: `[MODE: PRIVACY]` — International transfer compliance.

## Prerequisites

- Cloud infrastructure access (AWS, GCP, Azure) for region detection
- DNS and network flow logs for third-party transfer detection
- Vendor/processor list with data processing locations
- Knowledge of EU adequacy decisions (current as of assessment date)
- Python 3.10+ for transfer detection tooling

## Key Concepts

### EU Adequacy Decisions

```python
ADEQUATE_COUNTRIES = [
    "Andorra", "Argentina", "Canada (PIPEDA)", "Faroe Islands",
    "Guernsey", "Israel", "Isle of Man", "Japan", "Jersey",
    "New Zealand", "Republic of Korea", "Switzerland",
    "United Kingdom", "Uruguay",
    "United States (DPF participants)",  # EU-US Data Privacy Framework
]
```

### Transfer Mechanisms (Art. 46)

| Mechanism | Article | Use Case |
|-----------|---------|----------|
| Adequacy decision | Art. 45 | Transfer to adequate country |
| SCCs | Art. 46(2)(c) | Most common for vendor transfers |
| BCRs | Art. 47 | Intra-group multinational transfers |
| Codes of conduct | Art. 46(2)(e) | Industry-specific transfers |
| Certification | Art. 46(2)(f) | Certified processors |
| Derogations | Art. 49 | Explicit consent, contract necessity |

### Detection CLI

```bash
# Scan cloud infrastructure for cross-border storage
node scripts/agent.js --action scan-infra \
  --provider aws --output /tmp/transfer_map.json

# Map third-party vendors to data locations
node scripts/agent.js --action map-vendors \
  --vendors '[{"name":"Vendor A","country":"US","mechanism":"SCCs"}]' \
  --output /tmp/vendor_map.json

# Validate transfer mechanisms
node scripts/agent.js --action validate \
  --transfers /tmp/transfer_map.json --output /tmp/validation.json
```

## Workflow

### Step 1: Scan Infrastructure

```bash
node scripts/agent.js --action scan-infra --provider aws
```

### Step 2: Map Vendor Transfers

```bash
node scripts/agent.js --action map-vendors \
  --vendors '[{"name":"Analytics Co","country":"US","mechanism":"DPF"}]'
```

### Step 3: Validate Transfer Mechanisms

```bash
node scripts/agent.js --action validate --transfers /tmp/transfer_map.json
```

### Step 4: Remediate Unauthorized Transfers

For transfers without valid mechanisms: implement SCCs, restrict to adequate regions,
or obtain explicit consent under Art. 49 derogations.

## Verification

- [ ] All data storage regions mapped across cloud providers
- [ ] Third-party vendor locations documented with transfer mechanisms
- [ ] Adequacy status verified for each destination country
- [ ] SCCs executed and TIA completed for non-adequate countries
- [ ] Post-Schrems II supplementary measures assessed
- [ ] No unauthorized transfers to non-adequate countries without safeguards
- [ ] Transfer mapping reviewed quarterly

## References

- [GDPR Chapter V — Transfers (Art. 44–49)](https://gdpr-info.eu/chapter-5/)
- [EU Adequacy Decisions](https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en)
- [EDPB Recommendations 01/2020 on Supplementary Measures](https://edpb.europa.eu/our-work-tools/our-documents/recommendations/recommendations-012020-measures-supplement-transfer_en)
- [EU-US Data Privacy Framework](https://www.dataprivacyframework.gov/)
- [New SCCs (Commission Implementing Decision 2021/914)](https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj)
