# How are cross-border data transfers handled?

**Short answer:** Through the mechanism each jurisdiction recognizes — SDAIA-approved Standard Contractual Clauses for Saudi data, equivalent contractual safeguards elsewhere — backed by a completed Transfer Risk Assessment. Or avoided entirely, by deploying so that no data crosses a border.

## The contractual route

For Saudi-origin personal data, Cyber Crucible uses SDAIA pre-approved SCCs, adopted without modification apart from required fields, integrated into customer agreements or DPAs, and extended to any onward sub-processor transfer.

Other regimes recognize comparable mechanisms — adequacy findings, standard clauses, or consent-plus-safeguards. The common requirement is that the importer is contractually bound to protections equivalent to the exporting country's law.

## The Transfer Risk Assessment

Where transfer relies on safeguards such as SCCs, or involves sensitive data, a risk assessment is typically required. Cyber Crucible completed a TRA evaluating the nature of the data flows, the destination country's legal regime, the technical and organizational controls in place, and residual risks — with documented mitigations including data minimization, encryption, contractual terms, and incident handling.

## The architectural route

Contractual mechanisms manage a transfer. Not transferring removes it.

- **Air-gapped on-premises** — zero outbound telemetry, so there is no transfer at all.
- **Regional staging** — infrastructure positioned to keep processing within your jurisdiction.

For regimes with localization requirements — Nigeria being the clearest example — this is often the only clean answer.

> Documentation available from **dpo@cybercrucible.com**.