Question

A multinational retailer plans to transfer customer personal data from its European subsidiary to a cloud analytics platform hosted in a country that the European Commission has NOT deemed to provide an adequate level of data protection. The privacy officer must ensure the transfer is lawful before it begins. Which action should the privacy officer take FIRST to enable this cross-border transfer?

Accepted Answer

Implement Standard Contractual Clauses supplemented by a transfer impact assessment

Answer

Encrypt all data in transit using TLS before it leaves the European subsidiary

Answer

Obtain a signed acknowledgment from the cloud provider accepting all liability

Answer

Anonymize a sample of records to demonstrate compliance to the supervisory authority