Question

A European subsidiary of a US-based company plans to transfer employee personal data to its parent company's HR system hosted in a US data center. The company's legal team confirms the US recipient is not certified under any adequacy framework recognized by the EU. Which mechanism should the security and privacy team recommend to make this cross-border transfer lawful under GDPR while requiring the least dependence on future regulatory approval?

Accepted Answer

Execute Standard Contractual Clauses (SCCs) between the EU exporter and US importer, supplemented by a transfer impact assessment

Answer

Rely on the explicit consent of each employee as the sole legal basis for every transfer

Answer

Anonymize a subset of records and transfer the remaining identifiable data without additional safeguards

Answer

Delay all transfers until the EU issues a new adequacy decision covering the US recipient