Data residency, enough to ask
You are not going to resolve a transfer question in a design review, but you can recognise the two facts that make it one: whose data it is, and which border the inference call crosses.
A portfolio company is demoing an agentic onboarding flow. Somebody from the customer side asks where the data goes. The room produces three answers in ninety seconds: it is all in our AWS region, the model provider does not train on it, and we are SOC 2 compliant. None of those answers the question, and everybody moves on satisfied.
You are not going to resolve a transfer question in a design review, and you should not try. What you can do is recognise that a transfer question is what just went unanswered, and carry two facts out of the room that let someone who owns it pick it up.
Fact one: whose data
The regulation’s own definition is broad, and reading it is usually enough to end an argument about whether something counts:
“‘personal data’ means any information relating to an identified or identifiable natural person” (GDPR, Article 4(1))
Any information relating to. Not just the name and the account number. A session replay of an operator correcting a field is information relating to the person named in that field. A trace containing a retrieved chunk of somebody’s tenancy agreement is information relating to them. This is the sentence that converts “it is just telemetry” into a claim somebody has to defend.
Article 9 raises the stakes for a specific list — health data, biometric data used for identification, and the rest — whose processing “shall be prohibited” absent one of the conditions the article then lays out. For a document-extraction gate, this is not hypothetical. A passport crop, a medical letter, a benefits statement: the surface does not know what class of document it is showing, and the surface is the same surface either way.
Fact two: which border
Chapter V of the regulation is titled “Transfers of personal data to third countries or international organisations”, and its first three articles are the vocabulary you need:
- Article 44 — General principle for transfers.
- Article 45 — Transfers on the basis of an adequacy decision.
- Article 46 — Transfers subject to appropriate safeguards.
Notice the shape. This is a regime of conditional permission, not a storage-location rule. The European Data Protection Board’s own guide for small businesses says so about as plainly as a regulator says anything: transfers outside the EEA “are often essential”, and they are permitted where they comply with Chapter V, by an adequacy decision, by appropriate safeguards such as standard contractual clauses or binding corporate rules, or by one of the Article 49 derogations.
What an adequacy decision buys, and how long for
The European Commission describes adequacy as letting personal data flow “without any further safeguard being necessary”, with such transfers “assimilated to intra-EU transmissions of data.” The list of adequate countries includes the United States, but only for commercial organisations participating in the EU–US Data Privacy Framework. That is a per-vendor participation status you can look up, which is what makes it a question with an answer rather than a mood.
The status of that framework is the fastest-moving fact in this course, so here is where it stood when this lesson was checked on 5 September 2026, with the reasons to re-check it before you repeat it.
In Case T-553/23, the General Court dismissed the action for annulment against Commission Implementing Decision (EU) 2023/1795, which remains in force. Two qualifications in that press release do the real work: the Court confirmed adequacy as at the date the decision was adopted, not permanently, and noted that the Commission may suspend, amend or repeal it. An appeal, Case C-703/25 P, was lodged in October 2025 and no Court of Justice judgment exists.
Then, on 29 June 2026, the US Supreme Court decided Trump v. Slaughter, overruling Humphrey’s Executor and removing the for-cause protection that had shielded FTC Commissioners from removal. Adequacy under Article 45(2)(b) turns partly on the existence and effective functioning of independent supervisory authorities in the third country, and the Data Privacy Framework decision relies on that FTC protection at recitals 58 to 60. On 31 July 2026 the Chair of the EDPB wrote to the Commission asking it “to closely assess whether this development affects the functioning of Commission Implementing Decision EU 2023/1795.”
Where people get burned
Read the verb. The letter asks for an assessment. It does not suspend, and it does not ask for a suspension. An automated summary produced while researching this course reported it as a request to “suspend or repeal”, and reading the two-page PDF directly is what caught that. It is two pages. Read it rather than a summary of it, and apply the same discipline to whatever the status is by the time you need it.
The border a UI decides
The inference call is the transfer everybody thinks of, and it is usually the one the platform team has already considered. The ones that get missed are the ones a front-end decision added.
- The session-replay vendor. Recordings of a review gate are personal data under Article 4(1), and they go wherever that vendor processes them.
- The trace backend. A trace built to show exact inputs and outputs is carrying the document across whichever border the observability product sits behind.
- The error reporter. A component that captures props on an exception can send a field value to a service nobody listed as a processor.
- Anything the browser fetches from a third-party origin on that route. Covered from the attack side in the rendering lesson. This is the same mechanism producing a different kind of problem, with a different owner.
Each of those is a processor receiving personal data, and each has its own answer to the second fact. That mapping — from the list of third parties on a route to the list of borders crossed — is the contribution a front-end architect can make that nobody else on the team is positioned to make, because nobody else knows what is on the route.
Check your recall
Answer from memory — no scrolling back.
Retrieval check
Why is “the model provider does not train on our data” not an answer to a residency question?
Check your answer
Because it answers a different question. Training use and transfer are separate: data can cross a border, be processed, be logged, be retained, and never touch a training run. A no-training commitment constrains one downstream use. It says nothing about where the inference happened, which entity processed it, or under which Chapter V basis.
It is a good thing to have, and the reason it gets offered as an answer is that it is the thing a vendor has already written down. Notice the substitution when it happens. The follow-up is not adversarial: “that is useful and it is a different question — which basis covers the transfer itself?”
Hands on
Map one route to its borders
Done when: A one-page map for a single route: every third party that receives data from it, what kind of personal data each receives, and a Basis column that is either a named transfer basis you were told by the owner or the words “not established”. At least one row must say “not established”, or you have not been honest about how much of this you can answer alone.
- Pick the route with the most personal data on screen. For the extraction product that is the review gate; for the recommendation chatbot it is whichever screen holds the traveller profile.
- List every third-party origin the page talks to on that route. Network panel, then the tag manager, then the server-side integration list. All three, because each one hides things the others show.
- For each, write what it receives in Article 4(1) terms. Not “analytics events” — “the field labels and correction timings for a named individual’s tenancy agreement.” If you cannot describe it that concretely, you have not looked at the payload.
- Add a column for whether anything on the route could be Article 9 data. For a document gate the honest answer is usually “the surface cannot tell”, and that sentence is itself the finding.
- Add the Basis column and leave it empty. Fill it only with what an owner tells you. Guessing here is the specific failure this course exists to prevent, because a plausible guess gets repeated by somebody who trusts you.
- Write the question you would ask, as one literal sentence, into the matching
FLAG-LOG.mdrow. Bring the map and the sentence in. I will push on any row where the description of the data is vaguer than the payload you actually saw.
What this does not cover
Nothing here is legal advice and none of it is a basis for a decision. The regulation, the adequacy list, the General Court press release and the EDPB letter are all primary documents you can read, and reading them is what lets you ask a good question. Answering it is the privacy owner’s work, and the module on raising it properly is where you learn to name that owner in the same sentence as the flag.
It also has not asked how long any of this is kept. Where data goes and how long it stays are separate questions with separate owners, and the second one is almost never asked because nothing in the product ever forces the question. That is the retention lesson, and it closes this module.
Read this next — primary source
Regulation (EU) 2016/679 (GDPR), consolidated textEUR-Lex, Official Journal L 119, 4 May 2016 — free, the regulation itself, fetched 2026-09-05. EUR-Lex is hostile to automated fetchers and fine in a browser.
This lesson takes Article 4(1), Article 9, and the three article titles that open Chapter V. Read the regulation rather than a summary of it, and read Chapter V specifically: it is about six pages, it is written in plainer language than its reputation suggests, and having read it is what lets you tell the difference between a privacy owner explaining the rule and a vendor explaining a product. Every confidently wrong sentence about residency you will hear this year is a paraphrase of these six pages.
Stuck, curious, or think this lesson is wrong? Ask your teaching agent. The lessons are the scaffold; the conversation is where the learning gets unstuck.