Cross-Border Data Transfers: International Flights and Customs Holds

Opening Scene

A traveler cleared for entry into one country isn’t automatically cleared to board a connecting flight to a third country with entirely different entry rules. Customs holds exist precisely for this moment: a checkpoint not for the original border, but for the next leg of the journey. Personal data faces an equivalent hold every time it moves from a server in one country to a server in another, particularly when that second country doesn’t offer the same level of legal protection as the first.

In Plain English

Cross-border data transfer rules govern the movement of personal data out of a jurisdiction with strong privacy protections into one with weaker or different protections. Under GDPR, transferring EU personal data outside the European Economic Area requires a specific legal mechanism — an adequacy decision confirming the destination country’s laws are broadly equivalent, or, more commonly, standard contractual clauses (SCCs), a pre-approved set of contract terms that impose GDPR-equivalent obligations on the receiving party regardless of local law. Without one of these mechanisms in place, moving the data is unlawful even if collecting it in the first place was entirely proper.

The Old Way

Before cross-border transfer mechanisms were rigorously enforced:

Companies often replicated data globally across cloud regions for performance or redundancy reasons without separately assessing whether each destination country offered adequate legal protection.
The primary mechanism many companies relied on for EU-U.S. transfers, the Privacy Shield framework, was struck down by the European Court of Justice, leaving a legal gap that many organizations were slow to close.
There was limited practical enforcement of transfer rules for years, which let a considerable amount of non-compliant cross-border data flow continue largely unchallenged.

Requiring a specific, currently valid legal mechanism for every transfer — and actually enforcing that requirement — is what turned this into a genuine checkpoint rather than a formality.

What’s Changing (and Why AI Is the Reason)

Regulators have significantly increased enforcement of cross-border transfer requirements in recent years, with several high-profile cases specifically targeting EU-to-U.S. data flows.
This has pushed many organizations toward data residency strategies — keeping data physically within a region rather than relying entirely on legal transfer mechanisms — a trend closely tied to the multi-region architecture patterns covered in this content library’s dedicated access control and data security series.
AI services hosted primarily in the United States have made this issue acute for any organization sending EU personal data to a foundation-model API, since that single API call can itself constitute a cross-border transfer requiring its own valid legal basis.

The Metaphor, Fully Extended

The Customs Hold Before a Connecting Flight	Cross-Border Data Transfer Rules
A traveler cleared for one country needing separate clearance for the next	Data lawfully collected in one jurisdiction needing separate clearance to move to another
A bilateral agreement recognizing another country’s entry standards as equivalent	An adequacy decision recognizing a destination country’s privacy protections as equivalent
A signed waiver imposing the home country’s rules on the traveler abroad	Standard contractual clauses imposing GDPR-equivalent obligations on the receiving party
A held shipment pending proper transfer documentation	Data transfer blocked or exposed to enforcement without a valid legal mechanism

For Beginners: What to Actually Do

Learn the difference between an adequacy decision and standard contractual clauses as the two primary legal mechanisms for cross-border transfers.
Notice when a service you use is hosted in a different country than where you live, and consider what that implies about where your data actually travels.
Understand that lawfully collecting data in one country doesn’t automatically make it lawful to move that data elsewhere.

For Practitioners and Leaders: The Deeper Layer

Map every cross-border data flow in your organization’s architecture and confirm each one has a currently valid legal transfer mechanism attached to it.
Evaluate data residency architectures, keeping data within its region of origin, as covered in this content library’s dedicated access control and data security series, as a structural alternative to relying solely on legal transfer mechanisms.
For any AI service accessed via an external API, treat each API call carrying personal data as a cross-border transfer in its own right, and confirm the vendor relationship has appropriate transfer safeguards in place.

Quick Recap

Cross-border data transfers require their own legal justification, separate from the legal basis for collecting the data originally.
GDPR recognizes mechanisms like adequacy decisions and standard contractual clauses to authorize these transfers.
Regulatory enforcement of transfer rules has intensified, particularly for EU-to-U.S. data flows.
AI APIs hosted abroad can themselves constitute cross-border transfers, requiring their own valid legal basis.

Where This Fits in the Series

Article 9 covered the contracts governing data shared with processors. Article 11 looks at the risk assessment organizations are required to perform before undertaking any high-risk data processing activity in the first place: the Data Protection Impact Assessment.