{"id":5027,"date":"2023-09-12T17:01:35","date_gmt":"2023-09-12T21:01:35","guid":{"rendered":"https:\/\/solutionsreview.com\/security-information-event-management\/?p=5027"},"modified":"2023-09-12T17:08:57","modified_gmt":"2023-09-12T21:08:57","slug":"how-us-companies-balance-gdpr-compliance-with-international-data-transfers","status":"publish","type":"post","link":"https:\/\/solutionsreview.com\/security-information-event-management\/how-us-companies-balance-gdpr-compliance-with-international-data-transfers\/","title":{"rendered":"How US Companies Balance GDPR Compliance with International Data Transfers"},"content":{"rendered":"

\"GDPR<\/p>\n

Solutions Review\u2019s\u00a0Contributed Content Series<\/u><\/a> is a collection of contributed articles written by thought leaders in enterprise software categories. Ameesh Divatia of Baffle<\/a> takes a closer look at the world of GDPR compliance and international data transfers.<\/strong><\/em><\/p>\n

In May, the Irish Data Protection Commission levied a hefty $1.3 billion fine against Meta \u2014 the parent company of Facebook and Instagram \u2014 for transferring data from Ireland to the U.S. in a manner that was not compliant with the EU\u2019s General Data Protection Regulation (GDPR). Trans-Atlantic data transfers to the U.S. have been a rather nebulous prospect since 2020 when the Court of Justice of the European Union nullified the EU-U.S. Privacy Shield, which outlined rules for consumer data transfers outside of Europe.<\/p>\n

However, in July, we saw the adoption of the long-awaited EU-U.S. Data Privacy Framework (DPF) commenced, which addressed concerns related to U.S. intelligence access to European consumer data and created the Data Protection Review Court that will address consumer complaints should intelligence agencies gain access to EU consumer data. Now, companies that earn DPF certification can legally transfer consumer data to the U.S.<\/p>\n

Some may be under the impression that transfers can occur by simply earning DPF certification without concern of falling outside of GDPR compliance\u2014 but that would be a mistake. In 2021 \u2014 in response to the elimination of the Privacy Shield \u2014 the European Data Protection Board adopted six recommendations that companies should follow when transferring EU consumer data internationally. In addition to DPF certification, companies transferring data from the EU to the U.S. should integrate these six suggestions to ensure GDPR compliance.<\/p>\n

Let\u2019s take a closer look at those recommendations and what they mean.<\/p>\n
Widget not in any sidebars
\n

GDPR Compliance: How US Companies are Balancing with IDTs<\/strong><\/h2>\n
\n

Know Your Transfers<\/strong><\/h3>\n

This step is straightforward but can be challenging. The recommendation asserts that companies should identify every country where they plan to transfer data. While tedious, moving forward with the following five steps is only possible if you know where the data is going and, just as important, the level of protection each country offers (more on that later).<\/p>\n

Verify Your Transfer Tool<\/strong><\/h3>\n

Having the right solution provider can make GDPR compliance from the EU to another country much more manageable. It is essential to thoroughly vet your data transfer solution provider to ensure they follow stringent security measures that are also GDPR compliant. Ask the solution provider about its GDPR experience, how they support cloud-to-cloud portability, the availability of enhanced protection tools like Bring Your Own Key (BYOK), and the methods they employ for destroying data.<\/p>\n

Assess the Destination Country\u2019s Privacy Posture<\/strong><\/h3>\n

As we know, data protection standards are not uniform from country to country. To be clear, not all laws are as stringent as the GDPR. So, it is incumbent upon an organization seeking to transfer consumer data out of the EU to understand the destination country\u2019s level of protection.\u00a0 In the U.S., for example, about 20 percent of states have enacted data privacy laws, but all vary in scope.<\/p>\n

If the destination country does not have outlined data privacy standards or standards incompatible with the EU, a transfer cannot commence. Even when standards appear to comply with GDPR requirements, there may be gray areas. This is where solid legal counsel on your compliance team is critical. They can help you understand the nuances of the many compliance standards adopted by the countries you wish to transfer data.<\/p>\n

Identify and Adopt Supplemental Data Protection Measures<\/strong><\/h3>\n

This is perhaps the most complicated of the six steps because protecting data during processing is incredibly complex. The types of data protection methods to be employed may change based on the kind of data you\u2019re transferring, where it\u2019s going, where it is in the data processing timeline, and how you plan to use the data.<\/p>\n

The following are two broad categories of use cases identified as supplemental measures by the EDPB:<\/p>\n

    \n
  • Pseudonymize or encrypt the data before it leaves the jurisdiction where it is collected. <\/em>This includes a backup of sensitive data stored in a different location than where it was created. It would also ensure that sensitive data is not subject to the encryption regulations in the destination country, thereby providing a \u2018fail-safe\u2019 posture.<\/li>\n
  • Deploy state-of-the-art Privacy Enhanced Computation (PEC) techniques.<\/em> When feasible, these methods enable the processing of encrypted data using cryptographic approaches such as multi-party computing or homomorphic encryption. As mentioned earlier, BYOK is an emerging solution that protects encrypted data by giving owners complete control over encryption keys.<\/li>\n<\/ul>\n

    Take Formal Steps to Adopt Supplemental Protection Measures<\/strong><\/h3>\n

    This step requires ensuring protection measures are being implemented in a compliant manner. It is a best practice to establish and maintain lines of communication with appropriate authorities who can offer concrete counsel regarding the compliance-worthiness of protection measures. Doing so may create more work on the front end, but it is far less challenging than incurring a significant fine for non-compliance.<\/p>\n

    Re-Evaluate Enforcement<\/strong><\/h3>\n

    Companies regularly must review protection procedures to address any changes that may compromise data. New threats to data privacy emerge frequently, so it is absolutely critical to audit protection measures to ensure compliance is maintained irrespective of emerging threats before, during, or after data transfer.<\/p>\n

    As data privacy rules grow more stringent and as more businesses take on a global posture, companies must be more proactive than ever to protect consumer data\u2014 especially when leaving the EU. Organizations that follow the six recommendations by the EDPB will enjoy the fruits of global data analytics while avoiding non-compliance fines that can negatively impact an organization\u2019s bottom line and reputation.<\/p>\n
    Widget not in any sidebars
    \n","protected":false},"excerpt":{"rendered":"

    Solutions Review\u2019s\u00a0Contributed Content Series is a collection of contributed articles written by thought leaders in enterprise software categories. Ameesh Divatia of Baffle takes a closer look at the world of GDPR compliance and international data transfers. In May, the Irish Data Protection Commission levied a hefty $1.3 billion fine against Meta \u2014 the parent company […]<\/p>\n","protected":false},"author":888,"featured_media":5029,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[551,1],"tags":[],"acf":[],"yoast_head":"\nHow US Companies Balance GDPR Compliance with International Data Transfers<\/title>\n<meta name=\"description\" content=\"Ameesh Divatia of Baffle takes a closer look at the world of GDPR compliance and international data transfers.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/solutionsreview.com\/security-information-event-management\/how-us-companies-balance-gdpr-compliance-with-international-data-transfers\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"How US Companies Balance GDPR Compliance with International Data Transfers\" \/>\n<meta property=\"og:description\" content=\"Ameesh Divatia of Baffle takes a closer look at the world of GDPR compliance and international data transfers.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/solutionsreview.com\/security-information-event-management\/how-us-companies-balance-gdpr-compliance-with-international-data-transfers\/\" \/>\n<meta property=\"og:site_name\" content=\"SIEM Tools & Security Event Management | Solutions Review\" \/>\n<meta property=\"article:published_time\" content=\"2023-09-12T21:01:35+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2023-09-12T21:08:57+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2023\/09\/How-US-Companies-Balance-GDPR-Compliance-with-International-Data-Transfers.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"800\" \/>\n\t<meta property=\"og:image:height\" content=\"400\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Ameesh Divatia\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Ameesh Divatia\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/how-us-companies-balance-gdpr-compliance-with-international-data-transfers\/\",\"url\":\"https:\/\/solutionsreview.com\/security-information-event-management\/how-us-companies-balance-gdpr-compliance-with-international-data-transfers\/\",\"name\":\"How US Companies Balance GDPR Compliance with International Data Transfers\",\"isPartOf\":{\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/how-us-companies-balance-gdpr-compliance-with-international-data-transfers\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/how-us-companies-balance-gdpr-compliance-with-international-data-transfers\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2023\/09\/How-US-Companies-Balance-GDPR-Compliance-with-International-Data-Transfers.jpg\",\"datePublished\":\"2023-09-12T21:01:35+00:00\",\"dateModified\":\"2023-09-12T21:08:57+00:00\",\"author\":{\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/#\/schema\/person\/3d69610ee61c16fcf3adf87dc2693960\"},\"description\":\"Ameesh Divatia of Baffle takes a closer look at the world of GDPR compliance and international data transfers.\",\"breadcrumb\":{\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/how-us-companies-balance-gdpr-compliance-with-international-data-transfers\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/solutionsreview.com\/security-information-event-management\/how-us-companies-balance-gdpr-compliance-with-international-data-transfers\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/how-us-companies-balance-gdpr-compliance-with-international-data-transfers\/#primaryimage\",\"url\":\"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2023\/09\/How-US-Companies-Balance-GDPR-Compliance-with-International-Data-Transfers.jpg\",\"contentUrl\":\"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2023\/09\/How-US-Companies-Balance-GDPR-Compliance-with-International-Data-Transfers.jpg\",\"width\":800,\"height\":400,\"caption\":\"GDPR Compliance\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/how-us-companies-balance-gdpr-compliance-with-international-data-transfers\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/solutionsreview.com\/security-information-event-management\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"How US Companies Balance GDPR Compliance with International Data Transfers\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/#website\",\"url\":\"https:\/\/solutionsreview.com\/security-information-event-management\/\",\"name\":\"SIEM Tools & Security Event Management | Solutions Review\",\"description\":\"Evaluating Enterprise SIEM Systems, Log Management Analytics & SOAR Platforms.\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/solutionsreview.com\/security-information-event-management\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/#\/schema\/person\/3d69610ee61c16fcf3adf87dc2693960\",\"name\":\"Ameesh Divatia\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/5e57c7f1ae7d0cc76f900f28a1eaf559?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/5e57c7f1ae7d0cc76f900f28a1eaf559?s=96&d=mm&r=g\",\"caption\":\"Ameesh Divatia\"},\"description\":\"Ameesh Divatia is the co-founder & CEO of Baffle, Inc. He has a proven track record of turning technologies that are difficult to build into successful businesses, selling three companies for more than $425 million combined in the service provider and enterprise data center infrastructure market. Prior to starting Baffle, he led a premier CMOS photonics innovator (Lightwire Inc.) from technology development into product development leading up to an acquisition by Cisco Systems, Inc. for $271M within a time span of 29 months. He has also founded two venture-funded startups: Aarohi Communications (Storage Virtualization, acquired by Emulex Corporation for $39M) and PipeLinks Inc. (Optical Networking, acquired by Cisco Systems for $126M).\",\"url\":\"https:\/\/solutionsreview.com\/security-information-event-management\/author\/adivatia\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"How US Companies Balance GDPR Compliance with International Data Transfers","description":"Ameesh Divatia of Baffle takes a closer look at the world of GDPR compliance and international data transfers.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/solutionsreview.com\/security-information-event-management\/how-us-companies-balance-gdpr-compliance-with-international-data-transfers\/","og_locale":"en_US","og_type":"article","og_title":"How US Companies Balance GDPR Compliance with International Data Transfers","og_description":"Ameesh Divatia of Baffle takes a closer look at the world of GDPR compliance and international data transfers.","og_url":"https:\/\/solutionsreview.com\/security-information-event-management\/how-us-companies-balance-gdpr-compliance-with-international-data-transfers\/","og_site_name":"SIEM Tools & Security Event Management | Solutions Review","article_published_time":"2023-09-12T21:01:35+00:00","article_modified_time":"2023-09-12T21:08:57+00:00","og_image":[{"width":800,"height":400,"url":"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2023\/09\/How-US-Companies-Balance-GDPR-Compliance-with-International-Data-Transfers.jpg","type":"image\/jpeg"}],"author":"Ameesh Divatia","twitter_misc":{"Written by":"Ameesh Divatia","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/solutionsreview.com\/security-information-event-management\/how-us-companies-balance-gdpr-compliance-with-international-data-transfers\/","url":"https:\/\/solutionsreview.com\/security-information-event-management\/how-us-companies-balance-gdpr-compliance-with-international-data-transfers\/","name":"How US Companies Balance GDPR Compliance with International Data Transfers","isPartOf":{"@id":"https:\/\/solutionsreview.com\/security-information-event-management\/#website"},"primaryImageOfPage":{"@id":"https:\/\/solutionsreview.com\/security-information-event-management\/how-us-companies-balance-gdpr-compliance-with-international-data-transfers\/#primaryimage"},"image":{"@id":"https:\/\/solutionsreview.com\/security-information-event-management\/how-us-companies-balance-gdpr-compliance-with-international-data-transfers\/#primaryimage"},"thumbnailUrl":"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2023\/09\/How-US-Companies-Balance-GDPR-Compliance-with-International-Data-Transfers.jpg","datePublished":"2023-09-12T21:01:35+00:00","dateModified":"2023-09-12T21:08:57+00:00","author":{"@id":"https:\/\/solutionsreview.com\/security-information-event-management\/#\/schema\/person\/3d69610ee61c16fcf3adf87dc2693960"},"description":"Ameesh Divatia of Baffle takes a closer look at the world of GDPR compliance and international data transfers.","breadcrumb":{"@id":"https:\/\/solutionsreview.com\/security-information-event-management\/how-us-companies-balance-gdpr-compliance-with-international-data-transfers\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/solutionsreview.com\/security-information-event-management\/how-us-companies-balance-gdpr-compliance-with-international-data-transfers\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/solutionsreview.com\/security-information-event-management\/how-us-companies-balance-gdpr-compliance-with-international-data-transfers\/#primaryimage","url":"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2023\/09\/How-US-Companies-Balance-GDPR-Compliance-with-International-Data-Transfers.jpg","contentUrl":"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2023\/09\/How-US-Companies-Balance-GDPR-Compliance-with-International-Data-Transfers.jpg","width":800,"height":400,"caption":"GDPR Compliance"},{"@type":"BreadcrumbList","@id":"https:\/\/solutionsreview.com\/security-information-event-management\/how-us-companies-balance-gdpr-compliance-with-international-data-transfers\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/solutionsreview.com\/security-information-event-management\/"},{"@type":"ListItem","position":2,"name":"How US Companies Balance GDPR Compliance with International Data Transfers"}]},{"@type":"WebSite","@id":"https:\/\/solutionsreview.com\/security-information-event-management\/#website","url":"https:\/\/solutionsreview.com\/security-information-event-management\/","name":"SIEM Tools & Security Event Management | Solutions Review","description":"Evaluating Enterprise SIEM Systems, Log Management Analytics & SOAR Platforms.","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/solutionsreview.com\/security-information-event-management\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/solutionsreview.com\/security-information-event-management\/#\/schema\/person\/3d69610ee61c16fcf3adf87dc2693960","name":"Ameesh Divatia","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/solutionsreview.com\/security-information-event-management\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/5e57c7f1ae7d0cc76f900f28a1eaf559?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/5e57c7f1ae7d0cc76f900f28a1eaf559?s=96&d=mm&r=g","caption":"Ameesh Divatia"},"description":"Ameesh Divatia is the co-founder & CEO of Baffle, Inc. He has a proven track record of turning technologies that are difficult to build into successful businesses, selling three companies for more than $425 million combined in the service provider and enterprise data center infrastructure market. Prior to starting Baffle, he led a premier CMOS photonics innovator (Lightwire Inc.) from technology development into product development leading up to an acquisition by Cisco Systems, Inc. for $271M within a time span of 29 months. He has also founded two venture-funded startups: Aarohi Communications (Storage Virtualization, acquired by Emulex Corporation for $39M) and PipeLinks Inc. (Optical Networking, acquired by Cisco Systems for $126M).","url":"https:\/\/solutionsreview.com\/security-information-event-management\/author\/adivatia\/"}]}},"_links":{"self":[{"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/posts\/5027"}],"collection":[{"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/users\/888"}],"replies":[{"embeddable":true,"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/comments?post=5027"}],"version-history":[{"count":0,"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/posts\/5027\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/media\/5029"}],"wp:attachment":[{"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/media?parent=5027"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/categories?post=5027"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/tags?post=5027"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}