Cross-Border Data Transfer Playbook

1 · Why this playbook exists

Every sovereign AI deployment spanning more than one jurisdiction reaches the same point — usually week 2 of the procurement cycle — where the buyer's DPO / GC asks:

1. "Where does the data actually live?" (data residency)
2. "What lawful basis do you rely on for cross-border transfer?" (transfer mechanism)
3. "Have you done a Transfer Impact Assessment?" (TIA per Schrems II)
4. "What supplementary measures protect the data in the destination jurisdiction?" (encryption, pseudonymisation, contractual)
5. "Will you tell us when the transfer mechanism changes?" (continuous monitoring)

This playbook is the one-document answer to all five. It is not a substitute for buyer-side legal review — that happens at MSA signature — but it tells the DPO/GC exactly what DEFONEOS does, what mechanisms we rely on, and where the buyer must do their own homework.

2 · The data residency map (where DEFONEOS data lives)

By default, DEFONEOS does not transfer buyer data across borders. When transfer is unavoidable (e.g. buyer-side audit, support case, model improvement with explicit consent), the 5 named transfer mechanisms below apply.

3 · The 5 named transfer mechanisms

4 · Jurisdiction decision tree (which mechanism to use)

Decision rule: Pick the row matching the source jurisdiction, then the column matching the destination. If the cell is "Adequacy", no further mechanism required (but TIA still recommended for high-risk). If "SCCs" / "IDTA", buyer and DEFONEOS sign SCCs + UK Addendum (if UK involved) and conduct a TIA. If "Derogations", mechanism 5 applies (occasional only).

5 · Transfer Impact Assessment (TIA) — the SIGIL-anchored template

Every cross-border transfer requires a TIA. DEFONEOS publishes a TIA template per (source, destination, data type) tuple:

{
  "tia_id": "TIA-2026-07-14-UK-to-US-nonDPF",
  "source_jurisdiction": "UK",
  "destination_jurisdiction": "US (non-DPF certified recipient)",
  "data_categories": ["buyer_pii", "model_inference_logs"],
  "data_subjects": ["buyer_employees", "buyer_customers"],
  "volume_per_month": "estimated 50GB logs + 1M inference calls",
  "transfer_mechanism": "SCCs (2021/914) + UK Addendum (IDTA 2022)",
  "schrems_ii_assessment": {
    "destination_law_practice": "US Foreign Intelligence Surveillance Act §702 + Executive Order 12333",
    "buyer_necessity_assessment": "transfer required for model improvement with explicit consent",
    "supplementary_measures": [
      "End-to-end encryption (AES-256-GCM, customer-managed keys)",
      "Pseudonymisation at source (buyer-side pseudonym keys)",
      "Strict access controls (DEFONEOS staff with named BFT-cleared role only)",
      "Contractual prohibition on US government access disclosure beyond statutory minimum",
      "Annual TIA re-assessment with 33-agent BFT council review",
      "Real-time transfer log + buyer-facing webhook",
      "Data minimisation: only inference logs transferred; PII retained in UK"
    ]
  },
  "risk_rating": "MEDIUM (mitigated to LOW with supplementary measures)",
  "approved_by": "DEFONEOS DPO + Buyer DPO",
  "bft_council_vote": "28-approve / 5-amend / 0-reject (quorum 25/33)",
  "signed_at": "2026-07-14T...",
  "valid_until": "2027-07-14",
  "ed25519_sig": "..."
}

6 · The 7 Schrems II supplementary measures

For transfers to non-adequate jurisdictions (US non-DPF, etc.), DEFONEOS implements 7 supplementary measures — the technical, contractual, and organisational controls that bring residual risk down to LOW:

7 · EU-US Data Privacy Framework (DPF) — the certified path

DEFONEOS US entity is DPF-certified (effective 2026-04-01, certification valid 1 year, renewed annually). For transfers from EU to US, the DPF provides the simplest mechanism:

• DEFONEOS US LLC is on the DPF Active List (verify at dataprivacyframework.gov)
• EU personal data transferred to DEFONEOS US LLC is treated as adequate under DPF
• EU data subjects retain DPF redress rights (via DEFONEOS DPO + FTC / DOJ)
• DEFONEOS commits to DPF Principles: Notice · Choice · Accountability for Onward Transfer · Security · Data Integrity · Access · Recourse · Enforcement · Liability

DPF is currently under EU judicial review (Schrems III litigation); DEFONEOS monitors status and will fall back to SCCs + supplementary measures if DPF is invalidated. Fallback is automatic — no buyer action required.

8 · UK-US Data Bridge — the post-Brexit path

For UK-to-US transfers, the UK-US Data Bridge (effective 2023-10-12) extends the DPF to UK personal data. DEFONEOS US LLC is also UK Bridge-certified:

• UK personal data transferred to DEFONEOS US LLC is treated as adequate under UK Bridge
• UK data subjects retain UK Bridge redress rights (via DEFONEOS DPO + ICO)
• DEFONEOS commits to UK Bridge Principles (mirror DPF)

The UK Bridge is also under review; same fallback applies.

9 · Standard Contractual Clauses (SCCs) — the contractual path

When no adequacy decision or framework applies, DEFONEOS relies on the EU SCCs (2021/914) + UK Addendum (IDTA 2022). The signed SCC package covers:

• Module 1 (Controller-to-Controller) — for buyer-side controller transfers
• Module 2 (Controller-to-Processor) — for buyer-to-DEFONEOS processing
• Module 3 (Processor-to-Processor) — for sub-processor chains
• Annex I: List of parties · competent supervisory authority · data categories
• Annex II: Technical and organisational measures (TOA — see §6)
• Annex III: List of sub-processors (NCC Group escrow, etc.)
• UK Addendum: applied when UK GDPR also applies

SCCs are signed by both parties at MSA signature and re-signed on any material change (sub-processor change, data category change, jurisdiction change).

10 · Cross-walk to existing DEFONEOS artefacts

11 · The 5 Anti-Patterns (Cross-Border Disasters We Refuse)

1. No "we transfer as needed." Every transfer has a named mechanism + TIA + buyer consent.
2. No "we ignore Schrems II." TIA + 7 supplementary measures applied to every non-adequate transfer.
3. No "DPF is forever." We monitor Schrems III and fall back to SCCs automatically.
4. No "buyer can't audit transfers." Real-time transfer log + webhook + quarterly review.
5. No "sub-processor surprise." Sub-processor list in SCC Annex III; 30-day notice on change.

12 · Buyer Next Steps

1. Verify this playbook hash: curl https://csoai.org/defoneos-mod-cross-border-data-transfer-playbook.html | shasum -a 256
2. Verify DEFONEOS DPF certification: dataprivacyframework.gov (search "DEFONEOS" or "csoai")
3. Request a TIA for your specific (source, destination) tuple: dpo@csoai.org
4. Browse SCCs and UK Addendum template: csoai.org/dpa/sccs.pdf
5. Subscribe to transfer-mechanism change advisories: csoai.org/advisories/subscribe
6. Schedule a 60-minute cross-border walkthrough with our DPO.