Cross-Border Compliance Services

The Schrems II judgment (2020) transformed international data transfer law, invalidating Privacy Shield and imposing stringent assessment requirements for Standard Contractual Clauses. For organisations transferring personal data across borders—to the US, UK, Asia, or elsewhere—we provide expert guidance on adequacy assessments, transfer mechanisms, and multi-jurisdictional audit coordination.

The Schrems II Landscape

Post-Schrems II, the EU Court of Justice established that Standard Contractual Clauses (SCCs) alone are insufficient. Organisations must conduct Transfer Impact Assessments (TIAs) evaluating the legal regime in the destination jurisdiction. If destination laws permit government access to data without effective safeguards, SCCs must be supplemented with additional technical or organisational measures (like encryption) to ensure "an essentially equivalent level of protection" to the EU.

Key Principle: Before transferring personal data outside the EU/EEA, you must assess the legal framework and security conditions in the destination jurisdiction. SCCs require supplementary safeguards if the destination offers inadequate protection.

Our Cross-Border Compliance Services

Transfer Impact Assessments (TIA)

We conduct comprehensive TIAs evaluating the legal, regulatory, and technical environment in your data transfer destinations. This includes reviewing:

  • National surveillance laws and government access regimes
  • Adequacy decisions and regulatory frameworks
  • Technical security standards and encryption requirements
  • Supplementary safeguard mechanisms (contractual, technical, organisational)
  • Risk assessment and mitigation recommendations

Our TIA report provides evidence of a compliant transfer mechanism and defensibility in regulator scrutiny.

Standard Contractual Clauses (SCC) Optimisation

SCCs are the primary transfer mechanism post-adequacy decisions. We review and optimise your SCC implementations, ensuring they include appropriate supplementary safeguards and align with EDPB recommendations. This includes negotiating enhanced data protection clauses with vendors and processors.

Binding Corporate Rules (BCR)

For multinational groups transferring data between subsidiaries, Binding Corporate Rules provide a robust legal framework (subject to competent DPA approval). We design, document, and guide your group through the BCR application process, ensuring intra-group transfers are compliant and efficient.

International Transfer Mapping & Risk Assessment

We document all international data flows in your organisation, identify which transfers require additional safeguards, and develop a transfer compliance roadmap. This includes prioritising high-risk transfers and scheduling remediation timelines.

Multi-Jurisdictional Audit Coordination

For organisations with operations in multiple countries, we coordinate compliance audits across jurisdictions, ensuring consistent standards and identifying cross-border risk concentrations. This includes liaising with local DPOs or advisors in each territory.

Vendor & Processor Assessments

When engaging US cloud providers, tech vendors, or international processors, we assess their data protection frameworks, encryption capabilities, and contractual safeguards. This ensures your vendor agreements include appropriate SCCs and supplementary security measures.

Common Cross-Border Scenarios

Scenario 1: Transferring data to the US

US government surveillance laws (including the CLOUD Act and Executive Orders) create elevated risks for EU-US data transfers. We conduct risk assessments and implement supplementary safeguards (encryption, contractual limitations on US government disclosure) to ensure compliance under Schrems II.

Scenario 2: Multinational group with local subsidiaries

Your group operates in Portugal, Germany, Singapore, and Brazil. We map all intra-group data flows, identify which require BCRs or SCCs, and ensure consistent governance across jurisdictions.

Scenario 3: Cloud provider in non-adequate jurisdiction

You use AWS, Azure, or Google Cloud to store employee or customer data. We assess the provider's standard SCC terms, identify adequacy gaps, and recommend supplementary contractual or technical measures (e.g., encryption key management, data locality requirements).

Pricing & Engagement Models

  • Transfer Impact Assessment (Single Jurisdiction): €2,000–€4,000
  • Multi-Jurisdictional Transfer Mapping & Risk Assessment: €5,000–€10,000
  • SCC Review & Optimisation: €1,500–€3,000 per vendor
  • Binding Corporate Rules (Design & Application Support): €10,000–€20,000
  • Vendor Assessment & Due Diligence: €1,000–€2,500 per vendor

Multi-year engagements and retainer arrangements available for organisations managing complex cross-border operations.

Why Partner with Direct Hit?

  • EU & Global Expertise: We understand GDPR, Schrems II, and the evolving international data transfer landscape
  • Regulatory Intelligence: We monitor EDPB guidance, court decisions, and DPA enforcement trends affecting transfers
  • Risk Mitigation: Our assessments provide evidence of good faith compliance, reducing enforcement risk
  • Vendor Negotiation: We help you negotiate stronger data protection terms with US and international vendors

Ensure Your International Transfers Are Compliant

Schedule a consultation to assess your cross-border data flows and identify necessary safeguards.

Request a Consultation