Under GDPR Chapter V, sending personal data outside the EEA requires a legal transfer mechanism, and the transfers that cause problems are almost never the deliberate ones. They arise from ordinary infrastructure decisions: a CDN edge that caches a response containing personal data, a managed service whose control plane lives in another region, a logging pipeline that ships to a US endpoint, a support engineer with production access from outside the EEA. Because those decisions are made in code and configuration rather than in a contract, engineering is where the transfer becomes discoverable — and where an accurate transfer record has to start.
What counts as a transfer
Chapter V of the GDPR restricts transferring personal data to a third country or international organisation unless a valid mechanism applies — an adequacy decision, appropriate safeguards such as standard contractual clauses with supplementary measures where needed, or a narrow derogation.
The definition catches more than engineers expect. Copying data to another region is obviously a transfer. So is remote access: if an engineer outside the EEA can view personal data held inside it, that is a transfer even though nothing was replicated. So is a third-country vendor's ability to access data at rest in the EEA for support purposes.
Where transfers actually come from
Deliberate transfers get documented, because someone made a decision and told somebody. The problematic ones are incidental — they arrive as a side effect of a sensible infrastructure choice.
CDN and edge caching
An edge node caches a response. If that response contains personal data, the data is now at the edge, wherever the edge is. Edge compute makes this sharper, because logic executing at the edge may process personal data in a location chosen by routing rather than by you.
Managed-service control planes
You select an EEA region for the data plane and assume you are done. The control plane, the metrics, the audit logs and the vendor's support tooling may live elsewhere. Region selection covers where the data sits, not necessarily where everything that touches it runs.
Logging and telemetry
The most consistently overlooked path. Application logs contain user identifiers, IP addresses, email addresses in error payloads, and sometimes request bodies. If the logging pipeline ships to a third-country endpoint, personal data is being transferred continuously by a component nobody thinks of as a data store.
Backups and disaster recovery
Cross-region replication for durability is good engineering and a transfer if the target region is outside the EEA. The same applies to a disaster recovery site that has never been used.
Support and on-call access
A follow-the-sun rota means production access from wherever the engineer is. This is a transfer arising from an org chart rather than from infrastructure, which is why it is so often missing from the record.
Detecting them in your own stack
- Enumerate the regions configured across every account, including the ones set by default years ago and never revisited.
- Trace the logging and telemetry pipeline end to end, and check what personal data actually appears in log payloads.
- List every third-party endpoint the application calls at runtime and where each resolves.
- Check replication and backup targets, including disaster recovery sites that are never exercised.
- Map who can reach production personal data and from which country, including vendors with support access.
What the privacy team needs from you
A transfer record needs the destination country, the mechanism relied on, and the safeguards applied. Only the first of those is an engineering fact, but it is the one the rest depends on, and it is the one that changes without anyone telling the privacy team.
Practically, what helps is that the infrastructure facts reach the register automatically — hosting regions, subprocessor endpoints, replication targets — so a change of region shows up as a transfer to assess rather than as a discovery during the next audit. This is the same argument as for deriving the Article 30 record from code: humans do not reliably report configuration they set once and forgot.
The judgement stays with the privacy team
Engineering can establish that personal data reaches a given country by a given route. Whether the transfer mechanism is valid, whether supplementary measures are required, and whether the transfer is lawful at all are legal judgements, informed by supervisory authority guidance such as the EDPB's. The engineering contribution is an accurate, current picture of where data actually goes — which is the input most transfer assessments are missing.
If you want that picture derived from your own infrastructure, you can explore it at noru.tech.