# Cross border transfer assessment
> Source: https://legalcode.md/skills/legalcode-cross-border-transfer-assessment | [HTML version](https://legalcode.md/skills/legalcode-cross-border-transfer-assessment)

Assess the lawfulness of international personal data transfers under GDPR Chapter V, UK GDPR, and Swiss DPA (nDSG).

Assess the lawfulness of international personal data transfers under GDPR Chapter V, UK GDPR, and Swiss DPA (nDSG). Use when transferring personal data outside the EEA/UK/ Switzerland to a third country; when selecting or validating a transfer mechanism (adequacy decision, SCCs, BCRs, derogations); when building or reviewing a Transfer Impact Assessment (TIA) post-Schrems II; when assessing supplementary technical and organisational measures; when evaluating destination-country surveillance law (FISA 702, EO 12333, CLOUD Act, China PIPL/MPS, India DPDP); when reviewing Binding Corporate Rules for intra-group transfers; or when advising on Art. 49 derogations. Produces a mechanism selection decision, TIA, supplementary measures catalogue, risk classification (LAWFUL/RESTRICTED/UNLAWFUL per transfer), remediation roadmap, and Glass Box audit trail.

This skill performs a structured, end-to-end assessment of international personal data transfers for lawfulness under the three primary European transfer regimes. **This skill covers:** - Transfer trigger analysis — whether GDPR Chapter V applies to a given data flow - Mechanism selection decision tree — adequacy → SCCs → BCRs → derogations, with UK and Swiss parallel tracks - Transfer Impact Assessment (TIA) per the EDPB six-step methodology (Recommendations 01/2020, v2.0) and CNIL Practical Guide (January 2025) - Third-country legal framework assessment — surveillance law analysis for the US, China, India, and other high-risk destinations - EU-US Data Privacy Framework (DPF) assessment — current status, certification, and litigation risk (as of March 2026: PCLOB disruption and ongoing Schrems III proceedings) - UK GDPR parallel analysis — IDTA, UK Addendum to EU SCCs, ICO 2026 updated guidance, UK adequacy decisions post-Brexit - Swiss nDSG (revised DPA effective 1 September 2023) — FDPIC adequacy list, transfer tools - Supplementary measures — technical (encryption, pseudonymization, split processing), organisational (audit rights, deletion obligations), and contractual (enhanced SCCs) - Binding Corporate Rules (BCR) assessment — coverage, required 2024 updates, compliance gaps - Art. 49 derogations — specific situations, limitations on "occasional" use, consent requirements - ...

## Jurisdictions

Global



---
*Legalcode -- legalcode.md*