Cross Border Transfer Procedure

Scope

https://stressfly.com/wp-content/uploads/2025/12/CRO-QA-Observations-2025.xlsx

https://www.figma.com/design/qfF7btQd3Rq7og77BTjcny/Manoj?t=jnBN7DoWqkPaZrXv-0

his procedure covers the transfer of personal data between countries inside and outside the European Economic Area (EEA) or to international organizations, as well as any subsequent onward transfers. The procedure applies to all types of personal data, including special categories of personal data, as defined by the European Union’s General Data Protection Regulation (GDPR). This procedure applies to all NP Digital employees, contractors, volunteers, affiliates, board members, and third parties involved in processing of personal data on behalf of Neil Patel Digital, LLC, and its affiliated companies and brands (collectively, “NP Digital”).

Roles and Responsibilities

1. Data Protection Expert (DPE)
   1. The DPE is responsible for overseeing the implementation of this procedure and providing guidance on GDPR compliance relating to cross-border data transfers. The DPE should be consulted before any new cross-border transfer arrangement is established. To demonstrate our commitment to data protection, and to enhance the effectiveness of our compliance efforts, NP Digital has appointed a Data Protection Expert (“DPE”). NP Digital has determined that a DPO is not required pursuant to Article 37 of the GDPR, so a designated DPE will serve in place of a DPO. For purposes of this Policy, the designated DPE is Justin Redman (jredman@npdigital.com), In-House Counsel and Certified Information Privacy Professional/US (CIPP/US).
2. Data Controllers and Data Processors
   1. Data Controllers and Data Processors are responsible for complying with this procedure and ensuring that any cross-border personal data transfers are conducted in a manner consistent with the GDPR.

Adequacy of Data Protection

Before transferring personal data outside the EEA, the organization must ensure that the destination country or international organization provides an adequate level of data protection. This can be achieved through one of the following mechanisms:

1. Adequacy Decisions
   1. The European Commission may determine that a country, territory, or specific sector within a country, or an international organization, ensures an adequate level of data protection. In such cases, personal data can be transferred without any further safeguarding measures.
2. Appropriate Safeguards
   1. If there is no adequacy decision for the destination country or international organization, the organization must establish appropriate safeguards for the cross-border transfer of personal data. These safeguards can include:
      1. Standard Contractual Clauses (SCCs): Legally binding and enforceable data protection clauses adopted by the European Commission or a supervisory authority, which can be included in contracts between data controllers and data processors. Please contact the DPE for access to a Data Processing Agreement template, which contains SCCs that may be appropriate for the unique situation necessitating a data transfer.
      2. Binding Corporate Rules (BCRs): Internal rules for multinational companies or groups of companies that provide adequate safeguards for personal data transfers within the group. BCRs must be approved by the relevant data protection authorities.
      3. Codes of Conduct: Industry-specific guidelines that provide adequate safeguards for personal data transfers. Codes of conduct must be approved by the relevant data protection authorities and include binding and enforceable commitments by the data controller or processor.
      4. Certification Mechanisms: Certification schemes that demonstrate compliance with the GDPR’s requirements for personal data transfers. These schemes must be approved by the relevant data protection authorities.

Data Subject Rights and Consent

1. Informing Data Subjects
   1. Data subjects must be informed about the cross-border transfer of their personal data, including the destination country or international organization, the safeguards in place, and their rights related to the transfer. This information should be provided in a clear and transparent manner, typically through a privacy notice.
   2. Consent
      1. In some cases, the organization may rely on the explicit consent of the data subject to transfer personal data outside the EEA. Consent must be freely given, specific, informed, and unambiguous. Data subjects must be informed of the risks associated with the transfer and their right to withdraw consent at any time.

Record-Keeping and Documentation

The organization must maintain records of all cross-border personal data transfers, including the following information:

• The categories of personal data being transferred.
• The purpose of the transfer.
• The destination country or international organization.
• The legal basis for the transfer (e.g., adequacy decision, appropriate safeguards, consent).
• Any additional safeguards in place (ie: SCCs)
• The data protection authority’s approval, if applicable.

These records should be made available to the relevant data protection authorities upon request.

Monitoring and Review

The organization must regularly monitor and review its cross-border personal data transfer arrangements to ensure ongoing compliance with the GDPR and other applicable regulations. This includes:

• Keeping up to date with any changes in data protection laws, regulations, or guidance that may impact cross-border transfers.
• Periodically reviewing the adequacy of data protection in the destination country or international organization.
• Ensuring that appropriate safeguards remain in place and are effective.

Assessing any changes to the organization’s data processing activities that may impact cross-border transfers.

Incident Management and Reporting

In the event of a data breach or other incident involving personal data transferred outside the EEA, the organization must promptly notify the relevant data protection authorities and affected data subjects, in accordance with the GDPR’s requirements and the company’s Incident Response and Notification Policy.

Training and Awareness

All employees, contractors, and third parties involved in processing personal data on behalf of the organization should receive training on this procedure and their responsibilities related to cross-border personal data transfers. This training should be provided on a regular basis and updated as necessary to reflect changes in data protection laws, regulations, or guidance.