Which mechanism facilitates cross-border data transfers when there is no adequacy decision between the countries?

• A. Adequacy decisions.
• B. Binding corporate rules.
• C. Standard contractual clauses.
• D. Data localization requirement.

Answer: (C)

When there isn’t an adequacy decision for a country, you still need solid safeguards to transfer personal data across borders. Standard Contractual Clauses provide that safeguard by offering pre-approved contract terms, published by the European Commission, that bind the sending and receiving parties to uphold EU-level protection. These clauses create a contractual obligation to protect the data and to respect data subject rights, making the transfer lawful even to a country that hasn’t been deemed adequate. They’re widely applicable to many types of transfers and can be tailored to the specific arrangement.

Binding Corporate Rules exist as another valid path, but they’re mainly for transfers within a corporate group and require additional approvals, making them less universally applicable than SCCs. Data localization would keep data inside the country and isn’t a mechanism for transferring data abroad. Adequacy decisions, by definition, would remove the need for transfers safeguards, so they aren’t the mechanism used when no adequacy decision exists.

So, the mechanism that best fits this situation is Standard Contractual Clauses.