Real-world situations requiring specialist cross-border data protection impact assessment. Each scenario involves multiple jurisdictions, divergent legal frameworks and international data transfers.
Artificial intelligence systems with training, processing and deployment across multiple jurisdictions.
Large language models (LLMs), generative AI systems and data processing for distributed training across global data centres. Includes processing centres in the US, EU, Asia and CPLP.
USA, EU, UK, Singapore, Brazil, Canada, Australia.
Multi-region infrastructure, distributed deployment and hyperscalers (AWS, Azure, GCP).
Personal data stored and processed across data centres spanning continents. Includes automatic replication, cross-site backup and dynamic traffic routing. Hyperscalers like AWS, Microsoft Azure, Google Cloud with global presence.
USA (Virginia, N. California), EU (Frankfurt, Dublin, Amsterdam), Asia (Singapore, Tokyo), Brazil.
Consolidation of data between entities of the same multinational group in different countries.
Transfer of personal data (HR, customers, financial) between subsidiaries, branches and Shared Service Centres (SSCs) of a multinational group. Includes HR consolidation, global CRM, unified financial systems.
EU (multiple countries), USA, Brazil, Singapore, Australia, Japan.
Centralised platforms for human resources management across multiple international branches.
Human Resources Information Systems (HRIS) such as Workday, SAP SuccessFactors, Oracle HCM with people analytics, talent management, background checks and performance monitoring. Data processed centrally (e.g., USA) with local entity access.
EU (local HQ), USA (SaaS provider), Brazil (subsidiary), Asia (operations).
Expansion of operations in CPLP countries with developing data protection regimes.
Personal data processed and transferred in Angola, Mozambique, Timor-Leste, Guinea-Bissau, São Tomé and Príncipe with less mature regulatory requirements. Portugal as GDPR compliance gateway; Brazil under LGPD with comparable protection standards.
Angola (Lei 22/11), Mozambique, Timor-Leste (no specific law yet), Guinea-Bissau, São Tomé and Príncipe, Brazil (LGPD), Portugal (GDPR).
Multinational campaigns with cross-border profiling and customer data consolidation.
Global loyalty programmes, coordinated marketing campaigns across regions with customer profile consolidation, cross-border profiling and centralised consent management. Includes email marketing, targeted advertising and behavioural analytics.
EU (GDPR), USA (CCPA/CPA), Brazil (LGPD), Singapore, Australia.
Networks of cameras and surveillance systems with facial recognition across multiple international facilities.
Integrated CCTV systems across multiple countries with centralised storage, facial recognition, biometrics and analytics. Includes offices, shops, warehouses, critical facilities in EU, USA, Brazil and Asia.
EU (GDPR), USA (no federal law), Brazil (LGPD), China (heavily regulated surveillance), Singapore.
Financial services with open banking, credit scoring and AML/KYC compliance across multiple jurisdictions.
Fintech platforms with bank account access (open banking), automated credit scoring, customer due diligence (KYC) and anti-money laundering (AML) compliance. Data processed across multiple regions with complex regulatory compliance.
EU (GDPR, PSD2, MiFID II), USA (GLBA), Brazil (LGPD, Central Bank), Singapore, Australia.
| Scenario | Primary Risk | GDPR Legal Basis | DPIA Priority |
|---|---|---|---|
| Cross-Border AI | Training without consent; algorithmic bias | Art. 27 AI Act + Art. 35 GDPR | Critical |
| Cloud Computing | Storage in surveillance jurisdiction | Art. 44-49 GDPR (Schrems II) | Critical |
| Intragroup Transfers | Outdated BCRs; weak legal basis | Art. 46(2)(b) GDPR (BCRs) | High |
| Global HR Systems | People analytics without consent | Art. 35 + Art. 88 GDPR | High |
| CPLP Operations | Weak enforcement; no EU adequacy | Art. 44-49 GDPR (SCCs) | High |
| Global Marketing | Cross-border profiling; weak consent | Art. 6 + Art. 21 GDPR | Medium |
| Multinational CCTV | Facial recognition without consent | Art. 35 + Art. 9 GDPR | Critical |
| International Fintech | Credit scoring without explanation; AML/GDPR conflict | Art. 22 + Art. 35 GDPR | High |
Each of these scenarios requires a specialist DPIA. Identify your scenario and contact us for a focused assessment.
Send a brief message and we will respond within 24 hours.