Transfer Jurisdiction Assessments

Purpose and decision boundary

This report evaluates the destination jurisdictions currently evidenced or reasonably implicated by CIC's service architecture and user population. It is a public assessment, not a provider-specific legal opinion. A jurisdiction finding cannot approve a transfer unless CIC also confirms the actual exporter, importer, data, purpose, mechanism, onward recipients, locations, and safeguards.

The initial assessment covers the European Economic Area, United Kingdom, Nigeria, Canada, and United States. Any additional storage, support, subprocessor, workforce-access, or onward-transfer country discovered through owner evidence must be assessed before Restricted data is made available there.

Common assessment questions

For each destination, CIC considers:

• applicable privacy, surveillance, national-security, law-enforcement, and disclosure rules;
• whether public authorities can require access to the transferred data;
• necessity, proportionality, independent oversight, notice, challenge, and redress;
• whether the importer may disclose government requests and challenge disproportionate demands;
• practical data sensitivity, scale, frequency, retention, encryption, and key control;
• whether an adequacy decision or equivalent recognition applies to the actual recipient and transfer;
• whether contractual and supplementary safeguards can operate effectively in practice.

European Economic Area

Applicable posture

The EEA is a source region for CIC members and may also be a destination for providers or subprocessors. Transfers within the EEA remain subject to the GDPR but are not Chapter V third-country transfers merely because they cross EEA member-state borders. Transfers from the EEA to a non-adequate third country require an applicable Chapter V mechanism and an assessment of the destination context.

CIC requirements

• Identify the relevant CIC controller or processor establishment and exporter role.
• Record the importer role and the transfer mechanism for every EEA-origin transfer.
• Use the correct European Commission SCC module where SCCs are relied upon.
• Complete the Annex I, II, and III particulars rather than accepting generic uncompleted clauses.
• Verify whether an adequacy decision or certification actually covers the receiving entity and data.
• Apply the EDPB six-step transfer review and document effective supplementary measures.
• Provide GDPR transparency, data-subject rights, retention, and complaint routes.

Current determination

No blanket EEA transfer approval is issued. Provider-specific importer entities, SCC modules, annexes, and certification scope require owner evidence. Residual risk is Medium-High until that evidence and counsel review are complete.

Primary sources: European Commission adequacy decisions, European Commission SCC decision, and EDPB Recommendations 01/2020.

United Kingdom

Applicable posture

The UK GDPR restricts transfers to recipients outside the United Kingdom unless regulations, safeguards, or an applicable exception cover the transfer. A UK adequacy regulation must apply to the actual destination and recipient. Where CIC relies on the UK International Data Transfer Agreement or the UK Addendum to the EU SCCs, the selected document and completed particulars must match the transfer.

CIC requirements

• Identify the UK exporter, importer, roles, data, purposes, and destination countries.
• Select the IDTA or UK Addendum and retain the completed agreement.
• Apply the ICO transfer risk assessment data protection test to the actual circumstances.
• Identify onward transfers and remote support access, not only storage locations.
• Record supplementary measures and whether they address any material protection gap.
• Reassess following a destination-law change, provider change, security incident, or material data expansion.

Current determination

The repository evidence does not establish completed UK transfer agreements or provider-specific TRAs. UK-origin transfers are Medium-High pending factual confirmation and authorized legal review.

Primary sources: ICO international transfers guidance and ICO transfer risk assessment guidance.

Nigeria

Applicable posture

CIC has Nigerian users and financial integrations, making Nigeria both a likely source and possible destination. The Nigeria Data Protection Act 2023 establishes obligations for lawful processing, accountability, security, data-subject rights, and cross-border transfers. The organization must identify the applicable transfer basis and retain evidence that an adequate level of protection or another lawful safeguard applies.

CIC requirements

• Confirm the relevant CIC data controller or processor and any registration or filing obligations.
• Record the destination, recipient, legal basis, transfer safeguard, purpose, data, and retention.
• Assess sensitive and high-risk identity, nationality, KYC/KYB, bank, wallet, and transaction information with enhanced safeguards.
• Provide accessible privacy information and rights channels.
• Maintain vendor, incident, access, deletion, and transfer evidence.
• Obtain local counsel confirmation before relying on an exception for repeated or structural transfers.

Current determination

Cross-border processing of Nigerian member and applicant data is structurally likely because the public application is hosted outside Nigeria. The exact transfer basis, relevant entity, and provider terms require confirmation. Restricted-data transfers are High until those items are complete; other data is Medium-High.

Primary sources: Nigeria Data Protection Act 2023 and Nigeria Data Protection Commission FAQs.

Canada

Applicable posture

Canadian privacy accountability generally permits organizations to use service providers in other jurisdictions while retaining accountability and using contractual or other means to provide a comparable level of protection. Transparency about foreign processing and the possibility of lawful access is important. Provincial or sector-specific rules may add requirements depending on the CIC entity, user, data, and activity.

CIC requirements

• Identify whether PIPEDA, substantially similar provincial law, public-sector rules, or another regime applies.
• Tell affected users that information may be processed in another country and may be available to authorities there.
• Use contracts, diligence, access controls, monitoring, retention, incident obligations, and deletion controls to provide comparable protection.
• Confirm provider and subprocessor locations, including support access.
• Maintain an accessible contact for privacy questions and rights requests.
• Obtain Canadian counsel review where provincial, employment, health, credit, or other sector rules may apply.

Current determination

Canada-to-United States or other provider transfers require documented accountability and comparable-protection measures. CIC has relevant governance controls, but provider terms and actual destinations remain incomplete. Residual risk is Medium-High.

Primary source: Office of the Privacy Commissioner of Canada guidance on processing personal data across borders.

United States

Applicable posture

The United States is a confirmed hosting destination for CIC's public application services and may be a destination for database, source-control, authentication, communications, payments, banking, video, and support providers. US law is sectoral and includes lawful-access powers that require transfer-specific assessment. The CLOUD Act can apply to provider-held data within a provider's possession, custody, or control, subject to applicable process and challenges.

For eligible EEA-origin transfers, participation in the EU-US Data Privacy Framework may provide an adequacy route only where the exact importer is actively certified for the relevant data and the transfer falls within certification scope. CIC must not infer certification from a provider brand or parent company. UK and Swiss extensions require their own applicable scope.

CIC requirements

• Confirm each US importer legal entity, service, region, support model, and certification status.
• Verify certification directly at approval and at each review where it is relied upon.
• Otherwise execute the appropriate SCCs, UK terms, Nigerian safeguard, or other applicable mechanism.
• Assess government-access exposure in light of the data, importer, technical architecture, and request history.
• Prefer strong encryption, CIC-controlled or segregated keys where feasible, minimization, pseudonymization, masking, short retention, and restricted access.
• Require notice where lawful, request scrutiny, challenge commitments, transparency reporting, and onward-transfer controls.
• Suspend new Restricted-data transfers where effective safeguards cannot be established.

Current determination

US hosting is operationally necessary for the presently deployed architecture, but legal entity, DPA, transfer terms, service regions, and request-history evidence require owner confirmation. General service data is Medium-High; Restricted identity, financial, and recording data is High until provider-specific decisions are approved.

Primary sources: European Commission EU-US transfer information and US Department of Justice CLOUD Act resources.

Unconfirmed destinations

An unconfirmed country is not treated as low risk. Discovery of a new destination creates a temporary Not approved for new Restricted data state until the controlled transfer record contains:

• destination and access purpose;
• applicable law and regulator guidance;
• recipient and subprocessor identities;
• government-access and redress analysis;
• transfer mechanism and completed annexes;
• technical and organizational safeguards;
• privacy-owner, security-owner, business-owner, and counsel decisions.

Comparative legal and operational considerations

Comparative conclusion

Review triggers

This report must be reviewed when CIC adds a country, provider, subprocessor, remote-access location, data category, high-risk purpose, transfer mechanism, or materially different technical architecture; when relevant law or adequacy status changes; or when an incident or government request calls an assumption into question.

Limitation

This assessment was prepared with AI assistance and public legal sources. It requires factual confirmation and qualified legal review in the relevant jurisdictions.