Cross-Border Transfers of Biometric Data: GDPR Chapter V, the 2021 SCCs, the EU-US Framework and the UK Regime

A person in Madrid photographs a passport and records a selfie in a verification flow. The images travel to a server, a model compares the two faces, and a result comes back. Somewhere on that path someone in another country may be able to see the images: a support engineer with remote access, a storage region, a sub-processor. Chapter V of the General Data Protection Regulation asks whether that is a transfer, and if it is, which of a short list of tools makes it lawful. For biometric data the question weighs more, because processing biometric data for the purpose of uniquely identifying a person falls under the prohibition of Article 9(1) unless a condition applies. It weighs more for a second reason, which is our own observation: a face comparison needs the image or the template in a readable form while it runs.

This article walks through the primary texts in the order a reviewer meets them: what counts as a transfer, the three-rung ladder of Chapter V, the European Commission's adequacy decision for the United States and the court challenge to it, the 2021 standard contractual clauses, the assessment that the Court of Justice added in 2020, and the separate regime that now applies in the United Kingdom. It does not say where NeuroVision or any other provider keeps data, and it does not tell you which tool to choose.

For information; not legal advice.

The article closest to this one is biometric data under GDPR and UK GDPR, which settles whether a face template is special category data and which lawful basis and condition apply. This one begins where that one ends: once you have a lawful basis, may the data leave the territory, and on what footing? Two further articles are siblings: retention and erasure of identity data in verification callbacks covers how long the data stays, and the buyer guide on provider security and privacy lists the questions to put to a provider about sub-processors.

First question: is it a transfer?

The Regulation does not define the word. The European Data Protection Board says so in its Guidelines 05/2021, Version 2.0, adopted on 14 February 2023, and offers three cumulative criteria to decide when a processing operation is a transfer. First, a controller or processor, the "exporter", is subject to the GDPR for the given processing. Second, the exporter discloses by transmission or otherwise makes the personal data available to another controller, joint controller or processor, the "importer". Third, the importer is in a third country, irrespective of whether or not it is subject to the GDPR for that processing, or is an international organisation. If all three are met there is a transfer and Chapter V applies; if they are not, there is no transfer. Even then the Board reminds the reader that the controller must still comply with the other provisions of the GDPR and remains accountable wherever the processing happens, citing Article 5, Article 24 and Article 32.

Two points in the Guidelines matter for a verification flow.

The first is what "making available" means. The Board lists creating an account, granting access rights to an existing account, accepting a request for remote access, embedding a hard drive and submitting a password to a file. It adds that remote access from a third country, even if it takes place only by displaying personal data on a screen, for example in support situations, troubleshooting or administration, and storage in a cloud situated outside the EEA, are also considered to be a transfer, provided the three criteria are met. The Guidelines give the example of a company in a third country acting as a processor for EU controllers and remotely accessing data stored in the EU for support purposes: that remote access results in transfers from the EU controllers to their processor under Chapter V. For a reviewer, the consequence is that "the database is in Frankfurt" does not end the analysis. Who can open the record, from where, and for what task, is part of the question.

The second point is what is not a transfer. The Guidelines give the example of a person in Italy who fills in an order form on the website of a company in a third country that targets the EU market. The data subject passes the data to the company, which is therefore not an exporter, so the first disclosure is not a transfer, though the company must still apply the GDPR because Article 3(2) reaches it. In a related example, if that company then engages a non-EEA processor, its disclosure to that processor would amount to a transfer. A person who photographs their own face in a verification widget operated by a controller outside the EEA is in the first situation; the controller handing the images on to a processor outside the EEA is in the second.

A third example is worth a sentence. The Guidelines describe a Danish controller that uses a processor established in the EU which is a subsidiary of a third-country parent and is subject to third-country legislation with extraterritorial effect. The disclosure from controller to processor is not a transfer, but should the processor comply with a government access request, that disclosure would be considered a transfer under Chapter V, and the Board ties the controller's choice of processor to the requirement of sufficient guarantees in Article 28(1).

The structure of Chapter V

Article 44 states the general principle. Any transfer of personal data undergoing processing, or intended for processing after transfer, to a third country or an international organisation may take place only if the conditions laid down in the Chapter are complied with by the controller and the processor, including for onward transfers. The text adds that all provisions of the Chapter are to be applied to ensure that the level of protection guaranteed by the Regulation is not undermined.

Below that principle sit three rungs, and a transfer must stand on one of them.

Rung one: an adequacy decision (Article 45). A transfer may take place where the Commission has decided that the third country, a territory, one or more specified sectors, or the international organisation ensures an adequate level of protection, and such a transfer does not require any specific authorisation. The implementing act must provide for a mechanism for periodic review, at least every four years, and must specify its territorial and sectoral application. Where the information shows that adequacy is no longer ensured, the Commission is to repeal, amend or suspend the decision by implementing act without retroactive effect. A decision of that kind is without prejudice to transfers under Articles 46 to 49.

Rung two: appropriate safeguards (Article 46). In the absence of an adequacy decision, a controller or processor may transfer only if it has provided appropriate safeguards, and on condition that enforceable data subject rights and effective legal remedies are available. Article 46(2) lists six safeguards that need no specific authorisation from a supervisory authority: a legally binding and enforceable instrument between public authorities or bodies; binding corporate rules; standard data protection clauses adopted by the Commission; standard data protection clauses adopted by a supervisory authority and approved by the Commission; an approved code of conduct with binding commitments of the importer; and an approved mechanism of the kind Article 42 provides for, with binding commitments of the importer. Article 46(3) adds two more, which need the authorisation of the competent supervisory authority: contractual clauses between the parties, and provisions inserted into administrative arrangements between public authorities. Binding corporate rules have their own Article 47, which requires approval by the competent supervisory authority through the consistency mechanism and lists, in fourteen points, what the rules must specify at least.

Rung three: derogations for specific situations (Article 49). Where there is neither an adequacy decision nor appropriate safeguards, a transfer or set of transfers may take place only on one of seven conditions. They include explicit consent after the data subject has been informed of the possible risks due to the absence of an adequacy decision and appropriate safeguards, necessity for the performance of a contract with the data subject, important reasons of public interest, and the establishment, exercise or defence of legal claims. A narrow residual route exists for a transfer that is not repetitive, concerns only a limited number of data subjects, is necessary for compelling legitimate interests not overridden by the data subject's interests, and is supported by an assessment and suitable safeguards; the controller must inform the supervisory authority and the data subject. Article 49(6) requires the assessment and the safeguards to be documented in the records of Article 30. The Board's recommendations, discussed below, stress that derogations cannot become the rule in practice and must be restricted to specific situations. A continuous flow of identity documents from a customer base is a poor fit for a rung built for exceptions; that is our reading, not a rule of the text.

A fence around the ladder: Article 48. A judgment of a court or tribunal, or a decision of an administrative authority, of a third country requiring a controller or processor to transfer or disclose personal data may only be recognised or enforceable in any manner if it is based on an international agreement, such as a mutual legal assistance treaty, in force between the requesting country and the Union or a Member State. The article says this is without prejudice to other grounds for transfer under the Chapter.

Adequacy and the United States

Adequacy is the simplest tool when it exists, and for the United States it has been tested before the EU courts three times. The General Court's press release of 3 September 2025 summarises the first two: in the judgments in Schrems I and Schrems II the Court of Justice declared the two previous adequacy decisions concerning the United States invalid, on the ground that they did not ensure a level of protection essentially equivalent to that guaranteed by EU law. The operative part of the Schrems II judgment of 16 July 2020, in Case C-311/18, states that Commission Implementing Decision (EU) 2016/1250, the Privacy Shield decision, is invalid.

The current decision. Commission Implementing Decision (EU) 2023/1795 of 10 July 2023 found, for the purpose of Article 45 of the GDPR, that the United States ensures an adequate level of protection for personal data transferred from the Union to organisations in the United States that are included in the Data Privacy Framework List, maintained and made publicly available by the US Department of Commerce. The scope matters: the decision covers organisations on that list, not every company in the United States. A reviewer therefore checks the importer's listing and the date, and asks what happens to the transfer if the listing lapses. The decision records that the United States adopted Executive Order 14086 on 7 October 2022, complemented by an Attorney General regulation on the Data Protection Review Court, and that the commercial framework was updated.

Biometric data appear in the decision in a useful place. Under the Choice Principle, specific safeguards apply to the processing of sensitive information, and the decision states that any data considered sensitive under Union data protection law, including genetic data and biometric data, will be treated as sensitive under the framework by the organisations on the list. That is a statement about the importer's obligations; it does not replace the exporter's own lawful basis and Article 9 condition.

The decision also builds in its own supervision. Article 3 requires the Commission to monitor continuously the application of the legal framework, and to evaluate its finding one year after notification and then at a periodicity decided in close consultation with the committee established under Article 93(1) of the GDPR and the European Data Protection Board. Where the Commission has indications that adequate protection is no longer ensured, it will inform the US authorities and, if necessary, decide to suspend, amend or repeal the decision or limit its scope.

The court challenge. In Case T-553/23, Latombe v Commission, the General Court dismissed on 3 September 2025 an action for annulment of the decision. The applicant argued that the Data Protection Review Court is neither impartial nor independent, and that the bulk collection of personal data in transit by US intelligence agencies, without prior authorisation by a court or independent authority, is not circumscribed clearly enough. The General Court rejected both pleas. On the first it found that the appointment and functioning of the court's judges are accompanied by safeguards, that judges may be dismissed only by the Attorney General and only for cause, and that the Attorney General and the intelligence agencies may not hinder or improperly influence their work. On the second it said that nothing in Schrems II suggests bulk collection must be subject to prior authorisation by an independent authority; at a minimum the decision authorising it must be subject to ex post judicial review, which US law provides through the court. The press release frames the result as a finding about the date of adoption, and notes that if the US legal framework changes the Commission may decide to suspend, amend or repeal the decision.

The judgment is not the end of the story. An appeal limited to points of law lay to the Court of Justice. Philippe Latombe lodged one on 31 October 2025, registered as Case C-703/25 P, and the Official Journal published the notice of the appeal on 22 December 2025. The notice records four grounds of appeal, two about the Data Protection Review Court and two about the bulk collection of data, and asks the Court of Justice to set aside the judgment and annul the decision or, alternatively, to refer the case back. We found no judgment on the appeal in the sources used for this article; check the Court's register for its current state before relying on this paragraph. A prudent reviewer treats an adequacy decision as a tool that can be taken away, and writes a fallback into the contract and the transfer file, as the later sections show.

The 2021 standard contractual clauses

When no adequacy decision covers the importer, the usual tool on rung two is the set of standard contractual clauses in Commission Implementing Decision (EU) 2021/914 of 4 June 2021. Article 1 of the decision says the clauses provide appropriate safeguards within the meaning of Article 46(1) and (2)(c) for a transfer by a controller or processor subject to the GDPR to a controller or processor whose processing of the data is not subject to the GDPR. That last condition shapes the scope: the clauses are for importers outside the GDPR's reach for the processing in question. The Commission's page on the clauses, fetched for this article, says the Commission is in the process of developing additional sets for transfers to controllers or processors outside the EU whose processing operations are directly subject to the GDPR.

Modules. The Annex combines general clauses with four modules, to be chosen according to the roles of the parties: Module One for controller to controller, Module Two for controller to processor, Module Three for processor to processor, and Module Four for processor to controller. In a typical verification arrangement a business in the EEA is the controller and its provider is the processor, so Module Two applies where the provider is outside the EEA, and Module Three where the provider in the EEA sends data to its own sub-processor outside it. The decision also states that the clauses set out the obligations required by Article 28(3) and (4) for a transfer from a controller to a processor or from a processor to a sub-processor.

Sensitive data. Clause 8 contains a sensitive-data provision, numbered 8.6 in Module One and 8.7 in Modules Two and Three. Its definition of sensitive data includes biometric data for the purpose of uniquely identifying a natural person. In Module Two the importer must apply the specific restrictions or additional safeguards described in Annex I.B, and Annex I.B asks the parties to describe the sensitive data transferred and the restrictions or safeguards applied, such as strict purpose limitation, access restrictions including access only for staff who have followed specialised training, a record of access, restrictions on onward transfers, or additional security measures. For a face verification flow, this is the place where the contract should say which images or templates are transferred, who can read them, and how access is logged.

Deletion and return. Under Clause 8.5 of Module Two, processing by the importer takes place only for the duration specified in Annex I.B, and after the services end the importer must, at the exporter's choice, delete all personal data and certify that it has done so, or return the data and delete existing copies. Clause 16(d) repeats the position on termination. This is where the clauses meet the retention design discussed in the sibling article on erasure.

Local laws and government access. Clause 14 is the contractual form of the Schrems II requirement. The parties warrant that they have no reason to believe that the laws and practices of the destination country, including requirements to disclose personal data or measures authorising access by public authorities, prevent the importer from fulfilling its obligations, and they declare that they took due account of elements including the specific circumstances of the transfer, the length of the processing chain, the categories and format of the data, the storage location, the laws and practices of the destination country, and any supplementary safeguards. They agree to document the assessment and make it available to the competent supervisory authority on request. The importer must notify the exporter promptly if it has reason to believe it is or has become subject to laws or practices not in line with this requirement, and the exporter must then identify appropriate measures and suspend the transfer if no appropriate safeguards can be ensured or if the supervisory authority so instructs.

Clause 15 adds obligations if a public authority asks for the data. The importer agrees to notify the exporter and, where possible, the data subject if it receives a legally binding request for disclosure or becomes aware of direct access, to try to obtain a waiver if the law prohibits it from notifying, to review the legality of each request and challenge it where there are reasonable grounds, to seek interim measures when it does, and to provide the minimum amount of information permissible. The Commission's questions and answers add that the clauses do not require the importer to challenge every request, only those it considers unlawful on reasonable grounds.

Governing law and forum. For Modules One to Three, Clause 17 gives the parties a choice of the law of an EU Member State that allows third-party beneficiary rights, and Clause 18 sends disputes to the courts of an EU Member State, adding that a data subject may sue the exporter or the importer in the courts of the Member State of habitual residence.

Changing the text. The Commission's questions and answers say the text may not be altered, except to select modules and options, to complete bracketed passages, to fill in the annexes, or to add safeguards that increase protection. If the parties change the text beyond that, the modified clauses may no longer be used as a basis for transfers unless approved by a national authority as ad hoc clauses under Article 46(3)(a).

Old contracts. The decision repealed Decisions 2001/497/EC and 2010/87/EU with effect from 27 September 2021, and contracts concluded before that date on the basis of those decisions were deemed to provide appropriate safeguards until 27 December 2022, provided the processing operations remained unchanged. A contract that still cites the repealed clauses today is a finding for a reviewer.

The assessment the Court added

The clauses were not enough on their own after 2020. In the second point of the operative part of Schrems II, the Court of Justice held that the appropriate safeguards of Article 46 must ensure that data subjects are afforded a level of protection essentially equivalent to that guaranteed within the Union by the GDPR read in the light of the Charter, and that the assessment must take into consideration both the contractual clauses and, as regards access by the public authorities of the third country, the relevant aspects of its legal system. The Court held in the third point that, unless there is a valid adequacy decision, the competent supervisory authority is required to suspend or prohibit a transfer under standard clauses if the clauses are not or cannot be complied with in the third country and the protection cannot be ensured by other means. In the fourth point it found that its examination of the earlier standard-clauses decision had disclosed nothing to affect its validity. Taken together, that is the rule behind Clause 14: the clauses stay valid, but each exporter carries the duty to check, case by case, whether they can work in the destination country.

The Board's Recommendations 01/2020, Version 2.0, adopted on 18 June 2021 after public consultation, turn the duty into six steps. Step one is to know your transfers, step two to identify the transfer tools you rely on, step three to assess whether the Article 46 tool is effective in the light of the law and practice of the third country, step four to adopt supplementary measures where it is not, step five to take the formal procedural steps those measures require, and step six to re-evaluate at appropriate intervals. The Board says the assessment must be done with due diligence and documented, and that supervisory and judicial authorities may request it. It also describes three situations in step three where practice matters, including where the transferred data or the importer fall or might fall within the scope of problematic legislation; in that third situation the exporter may suspend, add measures, or proceed without them only if it can demonstrate and document that it has no reason to believe the problematic legislation will be applied to the transferred data and the importer.

Annex 2 of the Recommendations lists example scenarios, called use cases. Use Case 1 is data storage for backup and other purposes that do not require access to the data in the clear. There the Board considers strong encryption an effective supplementary measure when a list of conditions is met, including that the keys are retained solely under the control of the exporter, or of an entity trusted by the exporter in the EEA or under a jurisdiction offering an essentially equivalent level of protection. Use Cases 6 and 7 are the ones a face-comparison service must read slowly. Use Case 6 describes a transfer to a cloud service provider or other processor that needs access to the data in the clear to execute the task assigned, where the public authorities' access powers go beyond what is necessary and proportionate. For that scenario the Board states that, considering the current state of the art, it is incapable of envisioning an effective technical measure to prevent that access from infringing the data subject's fundamental rights, and that transport encryption and encryption at rest do not suffice if the importer holds the keys. Use Case 7 reaches the same conclusion for remote access for business purposes where the importer processes the data in the clear. The Board adds that it does not rule out that technological development may offer measures that achieve the business purpose without access in the clear.

The scenario applies only where the problematic legislation in fact applies to the transfer, so it is not a ban. But it explains why a transfer of face images to an importer that must see them to compare them cannot be fixed with a stronger encryption setting alone; that is our reading of the scenarios applied to this use. The honest options for such a flow are an importer in a country where the step-three assessment comes out positive, processing that stays inside the EEA, or an importer that does not hold the readable data outside it.

Biometric data inside the transfer file

A transfer file for biometric verification should keep four questions apart, because they are answered by different documents.

1. Is there a lawful basis and an Article 9 condition for the processing at all? Chapter V sits on top of that and does not replace it; Article 9(1) prohibits the processing of biometric data for the purpose of uniquely identifying a natural person unless a condition in Article 9(2) applies.
2. Is the movement a transfer under the three criteria?
3. If it is, which rung and which tool, and what does the assessment of the destination country conclude?
4. What happens to the data at the end: deletion, return, written confirmation, and the fate of copies held by sub-processors?

It also helps to separate the artefacts that move. A document image, a selfie, a face template, a similarity score, a pass or fail status and a callback payload are different data with different risk; which of them cross a border, and when, is a design choice that belongs in the data-flow map of step one of the Recommendations. A callback that is designed to omit personal data keeps the readable data in one place, which is a design choice for the data-flow map.

The United Kingdom

The UK GDPR has its own Chapter V, and since early 2026 it differs from the EU text in structure and wording. The version published on legislation.gov.uk shows Article 44 omitted and Article 44A inserted with effect from 5 February 2026 by the Data (Use and Access) Act 2025 and its commencement regulations. Article 44A allows a controller or processor to transfer personal data to a third country only if the transfer is approved by regulations under Article 45A, is made subject to appropriate safeguards, or is made in reliance on a derogation, and the transfer complies with the other provisions of the Regulation.

The data protection test. For adequacy regulations, Article 45B says the test is met if the standard of protection for data subjects in the country is not materially lower than the standard under the UK GDPR and Parts 2 and 5 to 7 of the Data Protection Act 2018, so far as relevant to general processing. The factors the Secretary of State must consider include respect for the rule of law and human rights, the existence and powers of an enforcement authority, redress arrangements, rules on onward transfers, international obligations, and the constitution, traditions and culture of the country. For transfers made subject to safeguards, Article 46 now requires that the controller or processor, acting reasonably and proportionately, considers the data protection test to be met, which is the case if the protection after the transfer would not be materially lower than under the UK framework; what is reasonable and proportionate is determined by reference to all the circumstances, including the nature and volume of the personal data transferred. The wording differs from the EU's "essentially equivalent"; the texts do not say whether the results will differ in practice, and this article does not predict it.

Transfer risk assessments. The Information Commissioner's guidance, last updated on 15 January 2026, says the transfer risk assessment is now referred to in UK legislation as the data protection test, while the ICO still uses the term in its guidance.

The IDTA and the Addendum. The ICO has issued two sets of standard data protection clauses: the International Data Transfer Agreement, with four parts (tables, extra protection clauses, commercial clauses and mandatory clauses), and the International Data Transfer Addendum to the Commission's clauses, with two parts. The ICO states that the EU clauses are not valid on their own for restricted transfers under the UK GDPR, but using the Addendum lets a business rely on them. It says the Addendum may appeal to a business that operates in both the UK and the EEA and already uses the EU clauses, and that the Addendum can be used even by a business operating only under the UK GDPR. The templates it refers to, IDTA A.1.0 and Addendum B.1.0, were laid before Parliament on 2 February 2022. The ICO says it plans to update both documents in the course of 2026 to reflect the Data (Use and Access) Act, and that organisations should continue to use the current versions; it also says they can choose automatic updates when a new version is issued.

The UK extension. The ICO's guidance index points to adequacy regulations for the United States, the UK Extension, with checklists. We did not fetch the regulations themselves, so this article states nothing about their scope beyond the existence of that guidance.

A worked reading of three flows

The table sets out how the texts above sort three simplified situations. It is an illustration of the method, not advice on any real arrangement.

The third row shows why the first question matters: not every cross-border flow is a Chapter V transfer. The first two rows show why the answer is rarely "the database is in the EEA".

A transfer register

A reviewer can keep the result of the walk-through in one register, with a row for every importer, including recipients that only store or back up the data in encrypted form; whether a recipient can read the data, and who holds the keys, is recorded in its own column. The columns below follow the questions of this article, and the example rows are illustrations of how to fill them, not facts about any provider.

Two side notes

Switzerland has its own regime: the Federal Data Protection and Information Commissioner says data may be disclosed abroad if the destination's legislation guarantees an appropriate level of protection, and that the list amendment for the United States, for the Swiss-US Data Privacy Framework, came into force on 15 September 2024. We do not apply it to the scenarios above. The OECD adopted on 14 December 2022 a Declaration on Government Access to Personal Data Held by Private Sector Entities, with seven principles; it is not a transfer tool under Chapter V, but its principles read as a checklist of questions about a destination country's rules.

Questions to put to a provider

• In which countries can the provider's staff, and its sub-processors' staff, read the images, templates or results, even only on a screen?
• Which transfer tool applies to each of those flows, and for a US importer, is it on the Data Privacy Framework List today, with a fallback if the listing ends?
• If the 2021 clauses are used, which module, and where are the Annex I.B sensitive-data safeguards written down?
• Has the provider carried out the Clause 14 assessment for the destination country, and will it share it?
• What is the provider's process under Clause 15 if a public authority asks for the data, and has it received requests of that kind?
• For UK data, does the provider use the IDTA or the Addendum, and is it planning to move to the updated documents?
• At the end of the contract, how are deletion and return confirmed in writing, and what happens to backups and sub-processor copies?
• Does the provider's readable-data processing ever happen in a place where the Board's Use Cases 6 or 7 would apply?

What a platform can contribute

A NeuroVision integration has controls that serve retention and erasure decisions: retention in days is a setting of each scenario, erasure endpoints and an erasure confirmation webhook are available, and a callback can omit personal data. These controls limit what remains after a session; they are not a statement about where processing takes place. To discuss your transfer file and the questions above, contact the team.

Sources

All sources were fetched on 28 October 2026.

• Regulation (EU) 2016/679 (General Data Protection Regulation), Official Journal text, Publications Office of the European Union.
• Commission Implementing Decision (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries, Official Journal L 199, European Commission.
• Standard Contractual Clauses (SCC), page of the European Commission.
• The new standard contractual clauses: questions and answers, European Commission, May 2022.
• Commission Implementing Decision (EU) 2023/1795 of 10 July 2023 on the adequate level of protection under the EU-US Data Privacy Framework, Official Journal L 231, European Commission.
• Press release 106/25: judgment of the General Court in Case T-553/23, Latombe v Commission, Court of Justice of the European Union, 3 September 2025.
• Appeal brought on 31 October 2025 by Philippe Latombe, Case C-703/25 P, Official Journal C/2025/6610, 22 December 2025.
• Judgment of 16 July 2020, Data Protection Commissioner v Facebook Ireland and Schrems, Case C-311/18, Court of Justice of the European Union.
• Recommendations 01/2020 on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data, Version 2.0, adopted 18 June 2021, European Data Protection Board.
• Guidelines 05/2021 on the interplay between the application of Article 3 and the provisions on international transfers as per Chapter V of the GDPR, Version 2.0, adopted 14 February 2023, European Data Protection Board.
• UK GDPR, Chapter V as amended, legislation.gov.uk, The National Archives, United Kingdom.
• What are standard data protection clauses (the UK IDTA and the Addendum)?, Information Commissioner's Office, United Kingdom.
• International transfers, guidance index, Information Commissioner's Office, United Kingdom.
• Completing a transfer risk assessment, Information Commissioner's Office, United Kingdom, updated 15 January 2026.
• Cross-border transfer of personal data, Federal Data Protection and Information Commissioner, Switzerland.
• Declaration on Government Access to Personal Data Held by Private Sector Entities, OECD/LEGAL/0487, Organisation for Economic Co-operation and Development, adopted 14 December 2022.