Question 29
UnclassifiedA U.S. company certified to a cross-border transfer framework wants to hire a new overseas subprocesser. What should it focus on first?
Correct answer: A
Explanation
A certified cross-border transfer framework requires that onward sharing meet the framework’s transfer conditions before data moves to a new recipient. The company should first verify that “downstream transfer obligations and contractual controls” are in place so the new subprocesser is bound before any sharing begins.
Why each option is right or wrong
A. Whether downstream transfer obligations and contractual controls are satisfied before the new sharing begins
Under the relevant cross-border transfer framework, onward transfers to a new recipient are not automatic: the exporter must ensure the recipient is bound by the framework’s downstream transfer conditions and that the required contractual controls are in place before any personal data is shared. In practice, that means the first check is whether the new subprocesser can be lawfully covered by the existing transfer mechanism and related commitments before the transfer starts, rather than after onboarding.
B. Whether the subprocesser prefers weekly or monthly invoices
C. Whether the subprocesser uses open-office seating
D. Whether the subprocesser has a U.S. marketing team