Transfer mechanisms
reference australia Updated Sep 10, 2026 2 min read transfer-mechanisms.md
Transfer mechanisms identify the legal safeguard that permits a specific data transfer between locations.
Privacy regulations often restrict the movement of personal data across jurisdictions unless a recognized legal safeguard applies. A transfer mechanism records that safeguard on a data transfer.
Most transfers rely on reusable safeguards such as Standard Contractual Clauses (SCCs), Binding Corporate Rules (BCRs), adequacy decisions, or approved transfer frameworks. Some transfers rely on case-specific exceptions. For example, an individual may explicitly consent to the transfer, or the transfer may be necessary for legal proceedings. These exceptions are marked Yes under Special exemption.
| Transfer mechanism | Description | Special exemption |
|---|---|---|
| Adequacy / Equivalence Decision | Formal determination by a competent authority that another country, region, or sector provides a level of personal data protection substantially equivalent to domestic standards, allowing transfers without further authorization. | No |
| Binding Corporate Rules (BCRs) | Internal policies adopted by multinational corporate groups and approved by a data-protection authority, or an equivalent regulator, to permit intra-group personal data transfers under enforceable and consistent privacy protections. | No |
| Code of Conduct or Certification Mechanism | Approved industry codes or certification schemes that demonstrate compliance with data-protection standards. Organizations that adhere to them and offer binding commitments can rely on these as transfer safeguards. | No |
| Contract in Interest of Individual | Permitted exception allowing a transfer when necessary for concluding or performing a contract in the individual's interest between the data controller and another party. | Yes |
| Contract Necessary for Data Subject | Permitted exception allowing a transfer when it is necessary for the performance, or pre-contractual steps, of a contract directly with the individual whose data is transferred. | Yes |
| Explicit Consent | Informed, explicit consent from the individual after being told of potential risks due to the absence of adequate safeguards. | Yes |
| Framework or International Arrangement | Formal agreement or structured framework between jurisdictions, recognizing that participating organizations provide adequate protection for cross-border transfers, such as a bilateral or multilateral transfer framework. | No |
| Legal Claims or Proceedings | Transfer necessary for establishing, exercising, or defending legal claims, including judicial or administrative proceedings. | Yes |
| Public Interest | Transfer required for reasons of significant public interest recognized in law, policy, or regulation. | Yes |
| Public Register | Transfer of information from a register that is legally intended for public access or for persons with legitimate interest, under defined access conditions. | Yes |
| Standard Contractual Clauses (SCCs) | Pre-approved or regulator-endorsed contractual templates that data exporters and importers adopt to ensure appropriate safeguards for cross-border personal data transfers. | No |
| Transfers within Same Regulatory Area | Transfers within jurisdictions or regions governed by the same privacy regime, such as an economic area, trade bloc, or federal system, that are not considered cross-border and therefore, need no additional mechanisms. | No |
| Vital Interests of Individuals | Transfer necessary to protect the life, health, or safety of an individual who can't provide consent. | Yes |
- Add a transfer mechanism to a data transfer record
Assign a transfer mechanism to a data transfer record to document the legal safeguard that permits the transfer of personal data. - Manage transfer mechanisms in the Privacy Workspace
Add or update the existing transfer mechanisms in your Privacy Management application, so that privacy analysts can add them to data transfer records.
Parent Topic:Manage data transfers
Keywords transfer mechanismdata transfer
47 lines · 5.0 KB
--- title: Transfer mechanisms description: Transfer mechanisms identify the legal safeguard that permits a specific data transfer between locations. locale: en-US canonical_url: https://www.servicenow.com/docs/r/australia/governance-risk-compliance/privacy-workspace/transfer-mechanisms.html release: australia product: Privacy Workspace classification: privacy-workspace topic_type: reference last_updated: "2026-09-10" reading_time_minutes: 2 keywords: [transfer mechanism, data transfer] breadcrumb: [Manage data transfers, Use, Privacy Management, Governance, Risk, and Compliance] --- # Transfer mechanisms Transfer mechanisms identify the legal safeguard that permits a specific data transfer between locations. Privacy regulations often restrict the movement of personal data across jurisdictions unless a recognized legal safeguard applies. A transfer mechanism records that safeguard on a data transfer. Most transfers rely on reusable safeguards such as Standard Contractual Clauses \(SCCs\), Binding Corporate Rules \(BCRs\), adequacy decisions, or approved transfer frameworks. Some transfers rely on case-specific exceptions. For example, an individual may explicitly consent to the transfer, or the transfer may be necessary for legal proceedings. These exceptions are marked **Yes** under Special exemption. |Transfer mechanism|Description|Special exemption| |------------------|-----------|-----------------| |Adequacy / Equivalence Decision|Formal determination by a competent authority that another country, region, or sector provides a level of personal data protection substantially equivalent to domestic standards, allowing transfers without further authorization.|No| |Binding Corporate Rules \(BCRs\)|Internal policies adopted by multinational corporate groups and approved by a data-protection authority, or an equivalent regulator, to permit intra-group personal data transfers under enforceable and consistent privacy protections.|No| |Code of Conduct or Certification Mechanism|Approved industry codes or certification schemes that demonstrate compliance with data-protection standards. Organizations that adhere to them and offer binding commitments can rely on these as transfer safeguards.|No| |Contract in Interest of Individual|Permitted exception allowing a transfer when necessary for concluding or performing a contract in the individual's interest between the data controller and another party.|Yes| |Contract Necessary for Data Subject|Permitted exception allowing a transfer when it is necessary for the performance, or pre-contractual steps, of a contract directly with the individual whose data is transferred.|Yes| |Explicit Consent|Informed, explicit consent from the individual after being told of potential risks due to the absence of adequate safeguards.|Yes| |Framework or International Arrangement|Formal agreement or structured framework between jurisdictions, recognizing that participating organizations provide adequate protection for cross-border transfers, such as a bilateral or multilateral transfer framework.|No| |Legal Claims or Proceedings|Transfer necessary for establishing, exercising, or defending legal claims, including judicial or administrative proceedings.|Yes| |Public Interest|Transfer required for reasons of significant public interest recognized in law, policy, or regulation.|Yes| |Public Register|Transfer of information from a register that is legally intended for public access or for persons with legitimate interest, under defined access conditions.|Yes| |Standard Contractual Clauses \(SCCs\)|Pre-approved or regulator-endorsed contractual templates that data exporters and importers adopt to ensure appropriate safeguards for cross-border personal data transfers.|No| |Transfers within Same Regulatory Area|Transfers within jurisdictions or regions governed by the same privacy regime, such as an economic area, trade bloc, or federal system, that are not considered cross-border and therefore, need no additional mechanisms.|No| |Vital Interests of Individuals|Transfer necessary to protect the life, health, or safety of an individual who can't provide consent.|Yes| - **[Add a transfer mechanism to a data transfer record](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/governance-risk-compliance/privacy-workspace/add-transfer-mechanism-dt.md)** Assign a transfer mechanism to a data transfer record to document the legal safeguard that permits the transfer of personal data. - **[Manage transfer mechanisms in the Privacy Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/governance-risk-compliance/privacy-workspace/update-transfer-mechanism.md)** Add or update the existing transfer mechanisms in your Privacy Management application, so that privacy analysts can add them to data transfer records. **Parent Topic:**[Manage data transfers](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/governance-risk-compliance/privacy-workspace/data-transfers.md)
| title | Transfer mechanisms |
| description | Transfer mechanisms identify the legal safeguard that permits a specific data transfer between locations. |
| locale | en-US |
| canonical_url | https://www.servicenow.com/docs/r/australia/governance-risk-compliance/privacy-workspace/transfer-mechanisms.html |
| release | australia |
| product | Privacy Workspace |
| classification | privacy-workspace |
| topic_type | reference |
| last_updated | 2026-09-10 |
| reading_time_minutes | 2 |
| keywords | transfer mechanismdata transfer |
| breadcrumb | Manage data transfersUsePrivacy ManagementGovernanceRiskand Compliance |