Data protection
Bounded adviceCross-Border Transfer Review: where your data actually goes
AI vendors move data across borders by default, and most companies first draw their real transfer map because a customer's contract made them. The gap between what the architecture does and what the paperwork covers is where the exposure sits. One to two weeks to close it.
- Published range
- $1,500–3,500 / engagement
- Timing after intake
- 1–2 weeks
- Quoted in India
- ₹75,000–1,75,000 / engagement
Fixed scope, not hourly. Quoted before we start, with the exclusions written down. The India figure is a separate price for a separate market, not a conversion.
How this is actually run
One defined question answered properly - a system, a vendor, a transfer route, a questionnaire - with the reasoning written out and the documents to act on it.
The scope is fixed before the work starts, which is why the price is a published range rather than an hourly estimate. Anything outside it is quoted separately rather than absorbed quietly or billed by surprise.
- Why clients instruct us
- AI vendors move data across borders by default, and most companies discover their actual transfer map only when a customer's contract makes them draw one. The gap between what the architecture does and what the paperwork covers is where the exposure sits.
- What we actually do
- We map where data actually goes - including the subprocessors behind your vendors, which is the part usually missed - identify the mechanism each route relies on, and test whether that mechanism is in place and currently valid. Routes with no mechanism are named, with the options for fixing them and what each one costs you operationally.
- What sits outside this
- We address the transfer position. Re-architecting your systems to change where data sits is engineering work, and localisation decisions are a business matter we advise on rather than take.
- What you can show afterwards
- A transfer map tied to your actual vendor and subprocessor set, the mechanism relied on for each route, and a remediation list with owners - which is what a customer's data protection reviewer is actually asking to see.
What you receive
Where your data actually goes, which transfer mechanism each route relies on, and what has to change where a route has no mechanism at all.
We address the transfer position and the documentation around it. Re-architecting systems to change where data sits is engineering work, and localisation is a business decision we advise on rather than take.
- A transfer map of where data actually goes, including vendor subprocessors
- The mechanism each route relies on, and whether it is in place and currently valid
- Routes operating with no mechanism at all, named rather than buried
- What has to change for each, with the operational cost of each option
- The documentation a customer's data protection reviewer will ask to see
- A remediation list with owners and dates
What it costs, and what it replaces
Both figures are published ranges for the same unit of work. Ours is fixed before we start; if our process gets faster, that is our gain and your price does not move.
How engagements are structured →Published range for this engagement, against the span of the whole card. In India the same scope is quoted at ₹75,000–1,75,000 — a separate price for a separate market, not a conversion. Where in the range a quote lands is set by scope, entities and how much usable evidence already exists.
Midpoint $2,500 per engagement
How the work runs
01
Map the real flows
Including the subprocessors behind your vendors, which is the layer almost always missed and the one that most often breaks the paperwork.
02
Identify the mechanism
For each route: which mechanism it relies on, whether it is actually executed, and whether it is currently valid rather than valid when somebody signed it.
03
Find the gaps
Routes with no mechanism, mechanisms that no longer hold, and commitments to customers that your actual architecture contradicts.
04
Options and cost
What would fix each gap - paperwork, configuration, a different vendor, a different region - with the operational cost of each, so the decision is yours to make on real numbers.
What we need from you
- Your vendor list, including the AI services, and their current terms
- Architecture or data-flow diagrams, or a walkthrough with whoever can give one
- Customer contract clauses that restrict location or require specific mechanisms
- Any existing transfer documentation, however out of date
What we check before delivery
- The map is built from vendor documentation and configuration, not from assumptions about where a service runs
- Subprocessor layers are followed rather than stopping at your direct vendor
- Customer commitments are read against the actual position, and conflicts are named
- A second qualified reviewer checks the conclusions
When firms send us this
- A customer asked where their data is processed and you could not answer precisely
- You are adopting an AI vendor whose infrastructure spans several regions
- A contract requires data to stay in a region and nobody has verified that it does
- Your transfer documentation predates your current vendor set
Questions about cross-border transfer review
Is this not just a list of our vendors?
A vendor list is where it starts. The work is in the subprocessor layer, in checking whether the mechanism each route relies on is actually in place, and in reading all of it against what you have already promised your own customers. That last comparison is usually where the finding is.
What if we find a route with no mechanism?
Then you have found it rather than a regulator or a customer finding it, and you have options. We set out what each one costs operationally so you can choose, rather than presenting the most conservative answer as the only one.
Firms who send us this usually also send
This engagement
Scope it in fifteen minutes.
Cross-Border Transfer Review at $1,500–3,500 per engagement, delivered in 1–2 weeks after a complete intake. Scoping costs nothing, and we will say if a smaller engagement would serve you better.