UPI Study › Courses › Ethics in Technology › Free lessons › Lesson 6.4 Free with a free account
International Data Protection Frameworks and Cross-Border Compliance Challenges
Ethics in Technology · Chapter 6: When Big Data Becomes a Big Risk: Security Gaps, Legal Frameworks, and National DefenseSection 6.4 · lesson 25 of 11616 min · free with a free account
Free preview
Create a free account to keep watching
It takes a minute and costs nothing. Your free account unlocks all of Chapter 1 and 3 more lessons of Ethics in Technology.
Lesson complete
Earn the 3 college credits for Ethics in Technology
Enrolling adds a quiz after each lesson, the graded work and the official transcript. Recommended for credit by NCCRS.
Next lesson: How Digital Attacks Can Threaten Critical Infrastructure and National Defense →← Domestic Laws and Regulations That Govern Data Protection in the United StatesNext lesson: How Digital Attacks Can Threaten Critical Infrastructure and National Defense →
In this lesson
Common principles, different scopes, and lawful transfer mechanisms.
- Explain GDPR principles, scope, and roles
- Compare adequacy, safeguards, and derogations
- Trace transatlantic arrangements and transfer assessments
- Compare India, Brazil, and China with local requirements
Free study notes
Get this lesson's notes by email
The key points and 4 practice questions with answers, in your inbox. One email, free.
One email. Unsubscribe in one click.
Transcript
Everything said in the video, section by section (1,895 words). Read along, or search it.
Chapter 6
Privacy Across Borders
Personal information can cross borders quickly, while the law remains tied to particular jurisdictions and activities. A photograph may involve servers, backups, and vendors, located in several different countries. Those movements can create overlapping duties that are not simply stricter and looser versions of one rule. This lesson begins with GDPR principles, territorial scope, roles, and selected organizational responsibilities. We then examine routes for transfers, including adequacy decisions and appropriate safeguards. Schrems two explains why a signed contract, may need an additional assessment and effective protective measures. The history of transatlantic arrangements shows how surveillance and redress affect the legal framework. We compare India, Brazil, and China, recognizing different vocabulary, scopes, bases, and transfer conditions. India's phased commencement makes the date, especially important when identifying which obligations already apply. Multinationals need a useful common core, alongside jurisdiction-specific choices about transfers, permissions, and deadlines. The aim is to understand the framework, while preserving the conditions that a real compliance assessment must examine.
GDPR Principles
Accountability Requires Demonstrating Responsible Handling
The source's principles diagram identifies six handling principles and the separate responsibility to demonstrate compliance. Lawfulness, fairness, and transparency concern, a valid basis, fair treatment, and understandable information. Purpose limitation concerns defined purposes, and the rules governing compatible further use. Data minimization requires adequate, relevant information, limited to what the purpose needs. Accuracy requires reasonable attention to correctness, and necessary correction of personal information. Storage limitation addresses how long identifiable records remain necessary, subject to the applicable legal conditions. Integrity and confidentiality concern security, appropriate to the risks of the processing. Accountability makes the controller responsible, and requires it to demonstrate compliance with the handling principles. Records, assessments, and documented decisions, can provide evidence for that demonstration. The exact documentation duties depend on the activity, so not every organization has identical requirements. Responsible behavior and evidence belong together, without claiming that accountability was absent from every earlier law.
Scope and Roles
An Organization Without EU Premises Can Be in Scope
GDPR can apply to processing in the context of an establishment within the European Union. That connection can matter even when the processing itself, occurs somewhere outside the Union. Organizations elsewhere can also be in scope for relevant offers of goods or services to people there. Monitoring behavior taking place in the Union, can provide another basis for territorial coverage. The source's Bhopal shop prices in euros, delivers to Germany, and advertises in German. Those facts indicate deliberate targeting, rather than mere availability of a globally accessible website. A European office is therefore not always required for the relevant processing to fall within scope. A controller determines why and how processing occurs, while a processor acts on its behalf. The same organization can have different roles for different activities and relationships. A compliant controller-processor arrangement carries requirements beyond an ordinary commercial hosting agreement. Identify the relevant activity, territorial connection, and role, before assigning the resulting obligations.
GDPR Duties
A Lawful Basis Is One Part of the Assessment
Ordinary processing needs an appropriate lawful basis, with conditions suited to the actual circumstances. The six bases include consent, contract, legal obligation, vital interests, public task, and legitimate interests. Consent is one option, and withdrawal protects the individual rather than making every consent choice inappropriate. Rights include access and correction, with defined conditions for erasure, restriction, objection, and portability. Certain solely automated consequential decisions, also involve specific safeguards and exceptions. Breach notification generally requires prompt regulator notice, where the event is not unlikely to create risk. Where feasible, notice follows within seventy-two hours of awareness; delayed notice needs reasons. High-risk individual communication has its own requirements, including exceptions rather than one universal notification rule. Processing likely to create high risk requires impact assessment, before it begins. Unmitigated high risk can require consultation, and the higher fine tier reaches twenty million euros or four percent turnover. Those turnover figures use the preceding worldwide year, with the higher amount subject to the applicable infringement rules.
EU Transfer Routes
A Transfer Mechanism Adds to Ordinary Processing Duties
Transfers to a destination outside the relevant European framework, require an applicable legal route. An adequacy decision recognizes essentially equivalent protection for the destination or arrangement within its scope. It does not remove every ordinary obligation, concerning lawful processing, rights, and security. Appropriate safeguards include standard contractual clauses, and approved binding corporate rules for qualifying group transfers. Each mechanism has its own conditions, rather than offering permission through a label alone. Article forty-nine derogations provide specified exceptional routes, whose restrictions need careful assessment. Many should not become the foundation for routine repeated transfers in ordinary business. Identify the destination, recipient, information, and onward movements, rather than checking only the main server location. Vendor relationships and relevant remote access, may be important parts of the actual transfer analysis. A permitted transfer still needs an appropriate basis for the underlying processing itself. The transfer mechanism adds a layer of protection, rather than replacing the rest of responsible data handling.
Schrems II, 2020
A Contract Cannot Bind a Foreign Government
Schrems two was decided in July two thousand twenty, addressing international protection and surveillance concerns. The Court upheld standard contractual clauses in principle, while invalidating the Privacy Shield adequacy arrangement. A contract binds its parties, but cannot bind a foreign government that is not a party. Exporters must therefore assess whether relevant destination laws and practices, undermine effective protection under the safeguard. Identify the transfers and chosen tool, before assuming the contract completes the assessment. Where needed, supplementary measures must provide effective protection in the actual processing scenario. Encryption can help when key custody and processing prevent unauthorized access to readable information. It is not a universal cure, when the importer needs the information in readable form. If effective protection cannot be achieved, the organization cannot simply continue relying on an inadequate transfer. Document the evaluation and review relevant changes, rather than treating it as a one-time paperwork exercise. Signing clauses provides a starting mechanism, whose effectiveness still depends on the surrounding legal and technical facts.
Transatlantic History
Successive Arrangements Faced Surveillance and Redress Questions
Safe Harbor began in two thousand, and its adequacy decision was invalidated in two thousand fifteen. Privacy Shield followed in two thousand sixteen, before its invalidation in two thousand twenty. Surveillance powers and meaningful redress, were central concerns in those judgments. The Data Privacy Framework received an adequacy decision in July two thousand twenty-three. Its commercial transfer route concerns participating organizations, rather than every United States recipient automatically. It rests on intelligence safeguards, and a redress mechanism including the Data Protection Review Court. The General Court rejected Latombe's challenge in September two thousand twenty-five. An appeal was filed that October, and a June two thousand twenty-six order concerned intervention in the appeal. That procedural order is not a final judgment, resolving the merits of the appeal. Check current validity and recipient participation, before relying on the arrangement for a real transfer. Parallel clauses still need their own effective assessment, rather than providing automatic insurance against any possible future ruling.
India’s DPDP Framework
Phased Commencement Changes Which Duties Apply
India's Digital Personal Data Protection Act uses data principal and data fiduciary as important terms. The principal is the individual, while the fiduciary determines the purpose and means of processing. A consent manager provides a registered mechanism for managing permissions under its applicable requirements. Significant data fiduciaries are designated organizations, with additional oversight and audit duties. The Act was enacted in two thousand twenty-three, while the November two thousand twenty-five Rules provide phased commencement. Some machinery provisions applied immediately, rather than every substantive obligation beginning at once. The published timetable brings consent-manager rules after one year, and major substantive rules after eighteen months. Check which provision is operative, instead of treating passage and full implementation as the same event. Consent and specified legitimate uses form the framework for processing within its scope. The government can restrict destinations, while other laws and designated-fiduciary conditions can add relevant limits. The hosting choice therefore needs attention to timing, permitted processing, and all applicable transfer requirements.
Brazil’s LGPD
Similar Structure Does Not Mean Identical Duties
Brazil's LGPD uses a broad framework, with similarities to GDPR and important local differences. Processing in Brazil, collection there, and specified offers to people there, can bring activity within scope. It provides ten bases for ordinary personal-data processing, while sensitive information has separate conditions. Those counts do not mean that every basis is available for every possible activity. Individual rights and ANPD enforcement, form important parts of the national framework. Main provisions applied from two thousand twenty, with administrative sanctions beginning later. International transfers can rely on adequacy, approved contractual mechanisms, or other applicable statutory routes. Brazil adopted a specific international-transfer regulation in two thousand twenty-four. The relevant local mechanism and requirements must be checked, even where the terminology sounds familiar. An EU contract or consent does not automatically satisfy, every Brazilian obligation through resemblance alone. Similarity helps compare the frameworks, while the actual legal duties remain those of the applicable Brazilian rules.
China’s PIPL
Transfer Routes, Consent, and Localization Have Defined Conditions
China's Personal Information Protection Law took effect in November two thousand twenty-one. Its specified extraterritorial scope can cover services, or behavioral analysis concerning people in China. Foreign processors within that relevant scope, need a designated entity or representative in China. Separate consent applies to specified activities, alongside the law's other grounds and requirements. Transfer routes include security assessment, certification, and standard contracts, within the applicable conditions. Other legal routes, thresholds, and exemptions mean, the requirements should not be reduced to a blanket statement. Localization applies to defined operators and processors, rather than requiring every possible dataset to remain locally stored. The two thousand twenty-four cross-border provisions refined thresholds, and exempted certain transfers from specified procedures. Their exceptions must be assessed, without assuming every exemption removes all ordinary personal-information duties. PIPL also operates alongside cybersecurity and data-security law, within a wider legal system. Its shared vocabulary with GDPR does not make, its scope, state-access framework, or transfer requirements identical.
Compare Carefully
Penalty Headlines and Transfer Rules Have Different Bases
Comparisons require attention to the base, conditions, and activity behind each headline number. GDPR's higher tier uses worldwide turnover, or a specified euro amount when that is greater. India's schedule includes up to two hundred fifty crore rupees for specified safeguard failures. That selected maximum should not be treated, as the penalty for every possible violation. Brazil uses revenue-based monetary penalties, with a per-infraction ceiling under its statutory conditions. China's serious-case provision includes fifty million yuan, or five percent of the prior year's turnover. These amounts have different currencies, bases, and conditions, so a simple ranking can be misleading. Transfer approaches also differ, across adequacy, safeguards, restrictions, local procedures, and exemptions. Ordinary and sensitive data can receive different treatment, within the same country's framework. Foreign reach and enforcement duties require their own analysis beyond the selected penalty example. Use comparison to identify questions, rather than assume that similar words produce interchangeable obligations.
Multinational Practice
Build a Common Core, Then Resolve Local Requirements
A multinational can build a common core, while retaining local rules for obligations that differ. Inventory the information and locations, so the organization knows what it actually holds and moves. Justify collection and detail, secure access, manage retention, and provide workable processes for individual rights. Document decisions and responsibilities, so the chosen handling can be explained and reviewed. Local definitions determine which information, activity, or transfer falls within each framework. Different notification and response deadlines can create, several clocks during one incident or request. Consent formats and legal bases also differ, so one global checkbox may miss a local requirement. Vendor chains require attention to recipients and subprocessors, rather than only the immediate supplier. Some obligations may conflict in the actual circumstances, including localization and foreign access demands. Stricter settings help with compatible duties, while genuine conflicts need specific legal and architectural resolution. Review phased commencement and court decisions, because an arrangement's conditions can change after the system is designed.
About Ethics in Technology at UPI Study
Ethics in Technology (Computer Science 195) is a self-paced online course of 116 video lessons in 15 chapters, from cybersecurity basics, privacy and surveillance to big data, hacking, malware, network defense, intellectual property, cybercrime, encryption, emerging technology and digital citizenship. It carries a NCCRS credit recommendation for 3 semester credits.
Every lesson transcript is free on pages like this one, and the videos are free with a free UPI Study account. Enrolling adds a practice quiz after each lesson, the graded work and final exam that earn the credit, lifetime access, and an official transcript on completion. UPI Study has helped over 130,000 students with college credits. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.
Enroll now → Course details Download the syllabus All Computer Science courses
Compare: Cybersecurity vs Ethics in Technology · Which ethics course?
Why take it here
Why students take Ethics in Technology with UPI Study
Where the credit goes
Universities that work with NCCRS
Ethics in Technology carries a NCCRS credit recommendation. These universities work with NCCRS; some are UPI Study's signed partners. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.
Thomas Edison State UniversitySigned partner
University of the PeopleSigned partner
Charter Oak State CollegeSigned partner
Strayer UniversitySigned partner
Columbia Southern UniversitySigned partner
Indiana TechSigned partner
Penn StateWorks with NCCRS
Southern New Hampshire UniversityWorks with NCCRS
SUNYWorks with NCCRS
+many more cooperating universitiesFind my college →Find my college → Not listed? Ask Athena in the corner of this page, or book a 15-minute call.
FAQ
Questions students ask us
About International Data Protection Frameworks and Cross-Border Compliance Challenges
When does the GDPR apply to a company located outside the European Union?
How can personal data be legally transferred from the EU to another country?
What did the Schrems II ruling decide?
How do India's DPDP Act, Brazil's LGPD and China's PIPL compare with the GDPR?
About the Ethics in Technology course
How many college credits is Ethics in Technology?
How much does Ethics in Technology cost and what is included?
Which universities accept UPI Study credits?
How long does Ethics in Technology take?
How are the exams done?
How do my credits reach my college?
Ready for the full course? Earn 3 credits in Ethics in Technology.
116 video lessons, a quiz after each one, and the graded work that earns the credit. Recommended for credit by NCCRS.
3 credits · NCCRSEnroll →