A clinic in Lagos sends a patient's scan abroad for a second opinion. A shop in Kraków keeps its customer list on servers in Virginia. A fintech in Jakarta verifies new users through a vendor in Singapore. None of this is exotic — it is a Tuesday. Yet each of those transfers falls under a different rulebook, because the obligations change depending on where the sender sits, where the server sits, and where the person the data belongs to happens to live.
Those rulebooks are increasingly written at regional level, not national. Three approaches dominate the conversation: the European Union's, the APEC system's, and the African Union's, with ASEAN developing its own soft-law version alongside. They disagree less about privacy as an idea than about method — who proves what, to whom, and how often.
Three blocs, three instincts
Broadly: the EU starts from rights and asks a country to prove it protects them before data flows freely. APEC starts from trade and asks companies to certify that they handle data responsibly, wherever they operate. The African Union starts from sovereignty and capacity-building, setting continental principles that national laws then implement at very different speeds.
None of these is simply stricter than the others. They are strict about different moments in the pipeline — the border, the company, or the law on the books — which is why a transfer can be routine under one system and legally fraught under another.
The European Union: prove it before you move it
Since the General Data Protection Regulation took effect in 2018, moving personal data out of the EU requires a legal basis, and the default assumption is that data stays put unless a safeguard exists. There are three usual routes.
Adequacy decisions
The European Commission can declare a country's regime "adequate," which lets data flow without extra paperwork. Japan, the UK, Switzerland, Canada (for commercial organisations), Israel, New Zealand, Argentina, Uruguay and South Korea hold such decisions, and the US relies on the Data Privacy Framework agreed in 2023 after two earlier arrangements collapsed in court.
Contracts and assessments
Everyone else leans on Standard Contractual Clauses, Binding Corporate Rules for groups, or narrow derogations such as explicit consent. Since the Schrems II ruling in 2020, companies must also assess whether the destination country's surveillance laws undermine those contracts — a document known as a transfer impact assessment. In practice this is where small organisations struggle: not the principle, but the file they must be able to produce if a regulator asks.
The EU model is transparent and enforceable, with fines and a 72-hour breach notification clock. It is also slow and political: adequacy talks can take years, and the arrangement with the US has been litigated twice.
APEC: certify the company, not the country
APEC's Cross-Border Privacy Rules system, built on the APEC Privacy Framework, takes the opposite bet. Instead of certifying jurisdictions, it certifies organisations. A company that joins agrees to be bound by the framework's principles, submits to an approved accountability agent, and can then move data among participating economies with less friction. Around a dozen economies take part, including the US, Japan, Canada, Australia, Mexico, South Korea, Singapore, the Philippines and Chinese Taipei.
The appeal is interoperability: no waiting for a regulator to bless a country, no separate contract for every partner. The weakness is uptake and reach. Certification is voluntary, and consumers rarely know whether a given company holds it or what to do when something goes wrong. In 2022 several participants launched a Global CBPR Forum and added a separate track for data processors, an acknowledgement that the original design covered controllers more comfortably than vendors.
Africa: national laws first, continental rules catching up
The African Union's Malabo Convention, adopted in 2014, covers cybersecurity, personal data protection and electronic transactions. It took years to gather the ratifications needed to enter force, and it deliberately leaves the detail to member states. Countries have filled that space at their own pace: South Africa's POPIA, Kenya's Data Protection Act, Nigeria's Data Protection Act and Ghana's older data protection law each set their own transfer tests, regulators and complaint routes.
The result is a patchwork with real strengths — laws written for local conditions rather than imported wholesale — and a predictable weakness: uneven enforcement and uneven guidance on transfers. The AU's Data Policy Framework, adopted in 2022, is non-binding but usefully specific about harmonisation, and regional bodies such as ECOWAS and SADC have their own supplementary texts. ASEAN, meanwhile, has published model contractual clauses and a data management framework, betting that templates and peer learning will do more than treaties.
Where the differences actually bite
- Consent versus accountability. A company can rely on the same legal basis in two blocs and still be non-compliant in one, because the EU asks what safeguards travel with the data while APEC asks what the company promised.
- The vendor problem. Cloud providers, translation agencies, payment processors and analytics firms handle data for others. EU rules distinguish controllers from processors in detail; the APEC system only recently created a processor track; many national African laws are still catching up on the distinction.
- Speed of redress. An EU resident can complain to a supervisory authority with enforcement powers. Under a voluntary certification scheme, the practical remedy is usually the company's own dispute process.
- Cost. A newsroom, clinic or small exporter handling EU data needs contracts and assessments. The same organisation under a certification model pays a fee and adapts internal policy instead.
- Surveillance. All three systems claim to protect data from government overreach, but only the EU has built a court-tested mechanism for challenging foreign surveillance law as part of the transfer decision.
What this means if you read, publish or subscribe across borders
Data rules shape what you can actually see. Outlets block European visitors rather than risk unclear compliance. Localisation requirements can slow a story's publication abroad or complicate how a foreign correspondent stores source material. Payment systems for international subscriptions are governed by transfer rules that determine which processors a publisher can use in which country. And when a breach hits a service you use, the notification you receive — and how fast — depends on which bloc the company answers to.
For journalists, the practical consequence is to treat data location as part of source protection, not an IT detail. Ask where notes, recordings and contact lists are stored, who can access them, and which jurisdiction the provider answers to. If you are reporting on a company's data practices, the useful question is not "do they comply with GDPR" but "which regime are they actually claiming to comply with, and what does that obligation require them to show?"
A short checklist before you move data across a border
- Identify the people whose data you hold and where they live — that, not your office address, decides which rules apply.
- Map where the data physically sits, including backups and any subcontractor your vendor uses.
- Check whether the destination has an adequacy decision, a certification scheme your vendor holds, or neither.
- Keep the paperwork: contracts, assessments and internal policies. If you cannot produce them on request, you have not complied.
- Write down who answers a complaint, and how someone reaches them.
- Review annually; adequacy lists, frameworks and national laws all change.
These systems are converging on principles and diverging on mechanics, which means the friction will persist even as the language starts to match. If a transfer is central to your work — a clinical trial, a payroll provider, a source's files — take advice from a lawyer qualified in the relevant jurisdiction rather than relying on a summary like this one.
Photo: Bru-nO / Pixabay
