Data Protection Impact Assessment across jurisdictions: definition, regulatory frameworks and applicability in multinational operations.
A Cross-Border DPIA is a structured assessment of data protection impact across multiple jurisdictions, international operations and cross-border transfers.
Unlike a domestic DPIA (limited to one country or the EU), Cross-Border DPIA:
Schrems II and Transfer Impact Assessment are cornerstones of modern cross-border DPIA.
The Schrems II decision (July 2020) invalidated the EU-US adequacy decision (Privacy Shield) and reconfigured the transfer landscape:
TIA is the specialised assessment of whether data can be protected post-transfer. It includes:
The EDPB Recommendation on Supplementary Measures guides implementation of technical, legal and organisational protections to mitigate risks of state surveillance post-transfer.
Binding Corporate Rules and Standard Contractual Clauses do not substitute but interact with DPIA.
| Mechanism | What it is | Requires DPIA? | Notes |
|---|---|---|---|
| BCR (Binding Corporate Rules) | Internal binding policies within multinational group | Not mandatory, but recommended | EDPB 80/2018 — BCR must be approved by DPA; DPIA documents compliance |
| SCC (Standard Contractual Clauses — Decision 2021/914) | Commission standard clauses for intra-EU and extra-EU transfers | Yes — especially post-Schrems II | TIA (Transfer Impact Assessment) is integral part of DPIA when SCC used for third countries |
| Adequacy (Adequacy Decision) | Commission recognises equivalent protection level | Not mandatory, but DPIA documents local compliance | EU-US DPF (newly agreed), UK (post-Brexit), Japan, South Korea — still require DPIA for structural issues |
Overview of jurisdictions with adequacy decisions or under negotiation.
| Jurisdiction | Adequacy Status | Key Legal Frameworks | DPIA Note |
|---|---|---|---|
| USA | EU-US DPF (2023) — Conditional | CCPA, GLBA, HIPAA, state laws | Requires TIA and supplementary measures; Schrems II applies to stored data |
| United Kingdom | Adequacy (post-Brexit, 2021) | UK GDPR, UK Data Protection Act 2018 | DPIA documents compliance with UK DPA; divergences with EU GDPR at risk |
| Japan | Adequacy (2019) | APPI (Act on Protection of Personal Information, 2020) | Verify compliance with APPI Article 23 (international transfers) |
| South Korea | Adequacy (2020) | PIPA (Personal Information Protection Act) | Transfers require assessment under PIPA Article 17 |
| Brazil | No formal EU adequacy | LGPD (2020), RIPD (Transfer Resolution, 2020) | DPIA must map LGPD Article 5 XVII + Article 38 (transfers); Schrems II not applicable, but equivalent protection required |
| CPLP Markets | No EU adequacy | National laws vary (Angola, Mozambique, Timor-Leste) | Specialised DPIA; EDPB Recommendation on supplementary measures |
Differentiation with related assessments in the Portuguese ecosystem.
Article 35 GDPR, Article 38 LGPD
Risk assessment for high-risk operations (international transfers, large-scale processing, sensitive data).
Article 27 AI Act
Assessment of fundamental rights for high-risk AI systems (facial recognition, scoring systems).
Regulated Sectors (Finance, Health, Energy)
Compliance assessment with sector laws (MiFID II, NIS 2, GDPR + sector). Includes DPIA as component.
Impact of Public Policies (Transparency Law)
Impact of new public policies or administrative processes on fundamental rights.
When a cross-border AI system is implemented, it is common to execute in parallel DPIA (data protection) + FRIA (fundamental rights) + AICS (sectoral compliance).
Mandatory documentation per Article 35 GDPR and Article 38 LGPD.
Consult aipd.pt/obrigatoriedade for complete CNPD criteria on when DPIA is mandatory in Portugal.
Deepen knowledge on multi-jurisdictional obligations and methodology.
Multi-Jurisdictional Obligations →Send a brief message and we will respond within 24 hours.