What practice supports privacy when data are transferred across borders?

• A. Share data openly with no agreements.
• B. Use data transfer agreements and assess cross-border risks.
• C. Only transfer de-identified data with no governance.
• D. Transfer to any partner without consent.

Answer: (B)

When data cross borders, protecting privacy hinges on establishing formal safeguards and evaluating potential risks. Data transfer agreements lay out who can access the information, for what purposes, the security measures required, how data will be stored and destroyed, and how breaches will be managed. Pairing those agreements with an assessment of cross-border risks helps identify jurisdictional differences, potential government access, and re-identification threats, so you can put appropriate protections in place before sharing. This approach directly supports privacy and confidentiality obligations in TCPS 2 by combining contractual governance with proactive risk management.

Imagine sharing data openly with no agreements—that completely undermines privacy protections. Relying on de-identification alone without governance is also insufficient because re-identification remains possible and oversight is still needed. Transferring data to any partner without consent ignores participants’ autonomy and the ethical basis for data sharing.