Which of the following is an example of a data transfer mechanism used in DPAs for cross-border transfers?

• A. Data retention policy.
• B. Incident response plan.
• C. Standard Contractual Clauses (SCCs).
• D. Business continuity plan.

Answer: (C)

Cross-border data transfers need a legally recognized mechanism to ensure personal data remains protected when it moves outside the original jurisdiction. Standard Contractual Clauses are exactly that: pre-approved contractual terms issued for international transfers that bind both the data exporter and importer to uphold privacy, security, breach notification, and data subject rights. They provide a concrete, enforceable framework within a Data Processing Agreement for moves of data across borders.

The other options don’t serve as transfer mechanisms. A data retention policy governs how long data is kept, not how it’s transferred. An incident response plan outlines steps to detect and respond to security incidents, and a business continuity plan focuses on maintaining operations during disruptions.