Published: April 2023
The proliferation of new and updated data privacy laws around the world has resulted in a marked rise in the number of data transfer mechanisms. One such mechanism – and one of the most prevalent – is the implementation of contractual clauses between the data exporter and the data importer. These contractual clauses purport to govern how the data importer will process the personal data transferred to it. The clauses extend certain privacy safeguards which exist and are applicable to the data exporter and data importer in another jurisdiction.
This infographic shows the jurisdictions that have taken steps to standardize draft contractual clauses for transferring personal data internationally. There are at least 20 draft, template, or standardized contractual clauses or undertakings for international data transfers covering over 70 countries.
For information on global data adequacy capabilities, see this infographic.
Future research by the IAPP will detail the implementation of data transfer mechanisms across the globe, similarities and differences between them, and key takeaways for privacy professionals.
The IAPP Resource Center additionally hosts an "International Data Transfers" topic page, which updates regularly with the latest news and resources.
There are at least 20 draft, template or standardized contractual clauses or undertakings for international data transfers covering transfers from 71 countries.
Association of Southeast Asian Nations
All European Economic Area states
Bosnia and Herzegovina
Latin American Data Protection Board (RIPD)
Jurisdictions part of multiple regional contracts
† Covered by their own and RIPD contracts. | * Covered by EEA and RIPD contracts.