Question

A European healthcare company processes patient PII in a SaaS platform hosted in the EU. The vendor announces that it will begin replicating backup data to a data center in a country that the European Commission has NOT recognized as providing adequate data protection. The company's DPO must ensure the transfer remains lawful under GDPR. Which action is the MOST appropriate to enable this cross-border transfer to proceed?

Accepted Answer

Execute Standard Contractual Clauses (SCCs) with the vendor and conduct a transfer impact assessment before replication begins

Answer

Rely on the data subjects' implied consent since they already agreed to the SaaS platform's terms of service

Answer

Encrypt the backup data at rest, which exempts the transfer from GDPR cross-border requirements

Answer

Notify the supervisory authority within 72 hours of the replication, treating it as a reportable event