Cross-border data transfers and data sovereignty in the EU

Data rarely respects borders, but the law does. Moving personal data across jurisdictions is tightly regulated, and data sovereignty is rising up the agenda. This guide explains transfer mechanisms and what they mean for sourcing.

Available across the EU. DataSupplier sources and delivers this data in all 27 European Union countries — including Germany, France, Spain, Italy, the Netherlands and Poland — and across the EEA, in the format and cadence you need.

Why transfers are regulated

The GDPR restricts transfers of personal data outside the EU and EEA to protect the level of protection individuals enjoy. Sourcing data with a global footprint means understanding where it originates, where it is processed, and which transfer mechanism applies.

The main transfer mechanisms

• Adequacy decisions: the Commission recognises a country as offering adequate protection.
• Standard contractual clauses (SCCs): approved contract terms that safeguard transfers.
• Other safeguards: binding corporate rules and specific derogations.

Transfer impact assessments

Beyond signing SCCs, organisations may need to assess the destination jurisdiction and apply supplementary measures, a practice reinforced by case law. This is part of responsible sourcing where data crosses borders.

Data sovereignty and localisation

Separate from transfer law, some sectors and member states prefer or require data to stay within certain jurisdictions. Data sovereignty considerations can shape which sources and delivery environments are acceptable.

What it means for sourcing

Confirm the origin and processing locations of data before acquisition, identify the transfer mechanism, and document it. Where sovereignty matters, prioritise sources and delivery environments that meet the requirement.

Running a transfer assessment

Signing standard contractual clauses is rarely the end of the analysis. Case law expects a transfer impact assessment: look at the destination’s legal regime, the risk of government access, and whether supplementary measures (such as encryption or pseudonymisation) are needed to protect the data in practice. For sourcing, this means knowing not just that data crosses a border, but where it is processed, who can reach it, and what safeguard genuinely applies.

Residency and sovereignty as requirements

Separate from transfer law, some buyers, especially in the public sector and regulated industries, require data to remain within a jurisdiction, or to be processed only by entities subject to specific laws. Treat residency and sovereignty as explicit requirements in the spec: they can rule out certain sources and delivery environments, and discovering them late forces rework.

Sources & further reading

• EUR-Lex: Regulation (EU) 2016/679 (GDPR), Chapter V on transfers.
• European Commission: adequacy decisions and standard contractual clauses.
• European Data Protection Board: guidance on transfers and supplementary measures.
• EUR-Lex: Regulation (EU) 2023/2854 (Data Act).