Four-Country Privacy & Data-Transfer Assessment

Four-Country Privacy & Data-Transfer Assessment — Marea Digital Group

Illustrative work product prepared for a fictional company (Marea Digital). Not legal advice; local counsel and the DPF certification status of each processor must be verified before reliance. Data-protection assessments require confirmation by qualified counsel in each jurisdiction.

Prepared by: Isabel Contreras San Lucas, Legal Intern  |  Working language: English  |  Scope: Spain, Denmark, Mexico, Brazil

0. Executive summary and structure of the group

Marea Digital is a B2B SaaS group. Marea Digital, S.L. (Madrid, ~45 staff) is the operating client and functions as the group's EU hub. The US parent, Marea Digital, Inc. (Delaware), owns the intellectual property and hosts the group's central customer-data platform on Amazon Web Services in the us-east-1 region (Northern Virginia). Group data — both employee and customer/end-user data — is centralized on that platform and is accessible to the US parent for product operations and analytics. New operating subsidiaries have been incorporated in Spain (S.L.), Denmark (ApS), Mexico (S. de R.L. de C.V.) and Brazil (Ltda.); each hires local staff and signs local customers.

The single most consequential fact for this assessment is that personal data collected in four jurisdictions is routinely made available to a US-established parent. That triggers the international-transfer regimes of the GDPR (as applied in Spain and Denmark), Mexico's LFPDPPP and Brazil's LGPD simultaneously, over the same data map. This document builds one common business data map (Exhibit 1) and analyzes it consistently under all four regimes, culminating in the flagship comparison table (Exhibit 14) that answers the operational question the business actually asks: can the U.S. parent access the data, and what paperwork does each country require?

Regulators referenced: Spain — Agencia Española de Protección de Datos (AEPD); Denmark — Datatilsynet; Mexico — Instituto Nacional de Transparencia, Acceso a la Información y Protección de Datos Personales (INAI); Brazil — Autoridade Nacional de Proteção de Dados (ANPD).

Exhibit 1 — Data-flow diagram (structured description)

The group operates a hub-and-spoke topology. Personal data originates locally, is consolidated at the EU hub for group administration, and is replicated to / accessible from the US-hosted central platform. Read the nesting below as "flows into / is accessible to":

1. Data subjects (sources)
   1. Employees and job applicants of each local subsidiary (Spain, Denmark, Mexico, Brazil).
   2. Customer business contacts and their authorized end-users (the individuals who log into the SaaS product).
   3. Prospects / marketing leads captured by local sales teams and web forms.
2. Local operating subsidiary (first collection point — Marea Digital S.L. / ApS / S. de R.L. de C.V. / Ltda.)
   1. Local HR and payroll onboarding; local CRM entry; local customer contracting.
   2. Flows into → the EU hub for centralized administration, and into → the central platform for product delivery.
3. Marea Digital, S.L. — EU hub (Madrid)
   1. Consolidates group HR records and group-level customer/account data.
   2. Acts as the intra-EEA aggregation point before onward transfer; flows into → the US parent's central platform.
4. Marea Digital, Inc. — US parent (Delaware)
   1. Hosts the central customer-data platform on AWS us-east-1; owns the IP.
   2. Accesses group employee and customer data for product operations and analytics — this is the transfer/onward-access event of concern.
5. Sub-processors (illustrative — must be confirmed against the live vendor register)
   1. Amazon Web Services, Inc. — cloud hosting / infrastructure (us-east-1).
   2. Email / transactional messaging provider.
   3. Product analytics / telemetry provider.
   4. Customer-support ticketing platform.
   5. Payroll / HR information-system vendors engaged locally per country.

Note: the actual residency and onward-transfer behavior of each sub-processor (including whether AWS data remains in us-east-1 or is mirrored elsewhere) must be verified against contracts and each vendor's published sub-processor list. AWS's Data Privacy Framework certification status in particular must be verified (see Exhibits 7, 8 and 14).

Exhibit 2 — Controller / processor role matrix

Roles are assessed functionally (who determines purposes and means), not by label. The GDPR analysis (Spain, Denmark) uses controller/processor/joint-controller terminology; Mexico uses responsable (controller) / encargado (processor); Brazil uses controlador / operador. The equivalents are aligned in the table.

Key tension flagged: for customer end-user data, the group is contractually a processor for its customers, yet the US parent's use of that data for its own product analytics can convert it into an independent controller for that purpose — which the customer DPA must authorize and the privacy notice must disclose. This dual role is where most transfer and lawful-basis risk concentrates.

Exhibit 3 — Employee-data inventory

Exhibit 4 — Customer / end-user data inventory

Exhibit 5 — Vendor / sub-processor questionnaire

To be completed for every processor and sub-processor before onboarding and re-confirmed annually. Answers feed the DPA (Exhibit 6) and the transfer analysis (Exhibits 7–8, 14).

1. Legal name, jurisdiction of establishment, and group affiliations of the vendor.
2. Exact categories of personal data and data subjects the vendor will process on the group's behalf.
3. Processing purposes and confirmation that the vendor will act only on documented instructions.
4. Physical location(s) of data storage and of all facilities from which data can be accessed (name the AWS region — confirm us-east-1 and any replication).
5. Full list of onward sub-processors, their locations, and the mechanism for notifying/objecting to changes.
6. Cross-border transfer mechanism relied upon (DPF certification, SCCs, LGPD art. 33 mechanism, Mexican transfer basis) with evidence.
7. For US-based or US-accessible vendors: current EU-US Data Privacy Framework certification status — verify directly on the official DPF list, including the specific certified entity and the "active" status.
8. Technical and organizational security measures (encryption in transit/at rest, access control, logging, pen-testing, certifications such as ISO 27001 / SOC 2).
9. Government-access / law-enforcement request handling, transparency reporting, and any history of compelled disclosure.
10. Personal-data breach notification commitment and maximum notification time to the group.
11. Support for data-subject rights (access, rectification, erasure, portability, objection) and assistance obligations.
12. Data return and deletion procedures on termination, with certification of deletion.
13. Audit and inspection rights, and availability of third-party audit reports.
14. Cyber-liability insurance, indemnities, and limitation-of-liability terms.
15. Confirmation of a signed DPA (and SCCs / transfer addendum where applicable) prior to any processing.

Exhibit 6 — Data-processing agreement (DPA) outline

Every controller-to-processor relationship in the map requires a written DPA. Under the GDPR the mandatory content is set by Art. 28(3); the same commercial substance is required under Mexico's LFPDPPP Regulation (encargado clauses) and Brazil's LGPD (operador obligations, arts. 39 and 47).

1. Subject-matter, duration, nature and purpose of processing; types of personal data and categories of data subjects (GDPR art. 28(3) chapeau).
2. Processing only on documented instructions of the controller, including for transfers (art. 28(3)(a)). MX/BR equivalent: process strictly within the controller's instructions.
3. Confidentiality commitments for authorized personnel (art. 28(3)(b)).
4. Security measures under art. 32; LGPD art. 46–47; LFPDPPP security-measure duties.
5. Sub-processor conditions — prior authorization, flow-down of terms, liability for onward parties (art. 28(3)(d), (4)).
6. Assistance with data-subject rights (art. 28(3)(e)); ARCO rights (MX); titular rights, LGPD art. 18 (BR).
7. Assistance with security, breach notification, DPIAs (art. 28(3)(f); arts. 32–36).
8. Return or deletion of data at end of services (art. 28(3)(g)).
9. Audit and information rights — make available all information to demonstrate compliance and allow audits (art. 28(3)(h)).
10. International-transfer terms — incorporate SCCs / DPF reliance / LGPD art. 33 mechanism as applicable, and cross-reference the TIA (Exhibit 8).
11. Breach notification timing from processor to controller (without undue delay), feeding Exhibit 11.
12. Liability, indemnity and governing law aligned to each controller's jurisdiction.

Exhibit 7 — Cross-border transfer checklist

Each outbound flow to the US parent (and to any non-adequate third country) must clear the checklist for its own regime before it goes live.

1. EEA → US (Spain & Denmark, GDPR Chapter V, arts. 44–49).
   1. First choice: adequacy via the EU-US Data Privacy Framework — Commission Implementing Decision (EU) 2023/1795 of 10 July 2023. Valid only if the specific US recipient (the AWS entity and/or Marea Digital, Inc.) is actively self-certified on the DPF list for the relevant data categories (HR data requires separate HR-data certification). Verify current certification status directly — do not assume.
   2. Fallback where DPF does not cover the recipient: Standard Contractual Clauses (Decision (EU) 2021/914) as an art. 46 safeguard.
   3. Under SCCs, a Transfer Impact Assessment is mandatory following Schrems II (CJEU C-311/18, 16 July 2020), assessing US surveillance law and supplementary measures. See Exhibit 8.
   4. Derogations under art. 49 (e.g. explicit consent, contract necessity) are for occasional, non-systematic transfers only — not a lawful basis for this routine, structural group transfer.
2. Mexico → US (LFPDPPP).
   1. International transfers are permitted without renewed consent in enumerated cases (LFPDPPP art. 37), including transfers to a parent/affiliate operating under the same internal policies, and transfers necessary for a contract in the data subject's interest.
   2. Where no exception applies, transfer requires the data subject's consent and disclosure in the privacy notice (aviso de privacidad).
   3. The transferor must ensure, by contractual means, that the recipient assumes the same obligations (LFPDPPP art. 36).
3. Brazil → US (LGPD, arts. 33–36).
   1. International transfer is lawful only via an art. 33 mechanism: adequacy recognition by the ANPD; ANPD standard contractual clauses / specific contractual clauses; binding corporate rules; or a listed derogation (consent, contract, legal obligation).
   2. Intra-group transfers to the US parent should rely on ANPD standard clauses / BCRs once the group adopts them; consent is a weaker fallback for routine flows.
   3. Confirm the current status of ANPD-approved transfer instruments before relying on them.
4. Common gate for all four: confirm lawful basis (Exhibit 3–4), signed DPA + transfer addendum (Exhibit 6), TIA on file (Exhibit 8), transparency in the privacy notice (Exhibit 9), and RoPA entry (Exhibit 13).

Exhibit 8 — Transfer-risk assessment (TIA) summary

This TIA summary applies to the routine EEA→US flow under SCCs and, by analogy, informs the Mexican and Brazilian intra-group transfers. It must be completed in full and refreshed if AWS's DPF status or US law changes.

1. Transfer described: group employee, customer/end-user and prospect data from the EU hub (and via it from all subsidiaries) to Marea Digital, Inc. on AWS us-east-1, for hosting, product operations and analytics — systematic and continuous.
2. Mechanism: DPF adequacy if and where the recipient is actively certified; otherwise SCCs (module 1 controller-to-controller and module 2 controller-to-processor as applicable).
3. Law of destination: US surveillance framework (FISA 702, EO 12333) as assessed in Schrems II; the 2022 Executive Order 14086 and the DPF redress mechanism are the basis for the 2023 adequacy decision — their sufficiency is the crux of DPF reliance and should be monitored for legal challenge.
4. Supplementary measures (where on SCCs): encryption in transit and at rest with group-controlled keys where feasible, strict access controls and logging, data minimization before transfer, contractual government-access transparency and challenge commitments.
5. Residual risk: government access to data in the clear at the US parent for analytics remains the principal residual risk; document the balancing conclusion and the trigger conditions for re-assessment.
6. Conclusion / posture: Amber pending verification of AWS/parent DPF certification. Turns Green if the specific recipients are actively DPF-certified for the relevant data categories (including HR); stays Amber on SCCs+supplementary measures; Red if neither is in place before go-live.

Exhibit 9 — Privacy-notice localization chart

All notices must disclose the international transfer to the US parent, the recipient, the mechanism relied upon, and how to exercise rights. The customer-facing notice must be consistent with what the customer DPA authorizes for the parent's analytics use.

Exhibit 10 — Data-subject request (DSR / ARCO / titular rights) workflow

One intake, four legal overlays. Rights map as: GDPR (access, rectification, erasure, restriction, portability, objection); Mexico ARCO (Acceso, Rectificación, Cancelación, Oposición); Brazil LGPD art. 18 titular rights (confirmation, access, correction, anonymization/deletion, portability, information on sharing).

1. Intake: single channel per country (email + in-product form), logged centrally.
2. Identity verification: proportionate to the request and data sensitivity.
3. Triage & role check: determine whether the group is controller or processor for the data (Exhibit 2); if processor, route to the customer-controller and assist.
4. Locate data: query local systems, the EU hub, and the US central platform (data must be findable across the map — this is why the RoPA and data map exist).
5. Assess & apply exemptions: legal-hold, third-party rights, statutory retention.
6. Respond within the statutory deadline: GDPR — one month, extendable by two (art. 12(3)); Mexico — 20 business days to respond, 15 to give effect (LFPDPPP art. 32); Brazil — access without undue delay / 15 days for full-form confirmation and access (LGPD art. 19).
7. Record & close: log outcome and timing for accountability (Exhibit 13).

Exhibit 11 — Incident-response / breach-notification matrix

Verify: the ANPD has issued regulation on breach communication timing; the current deadline must be confirmed before finalizing the runbook. The Mexican timing is "without delay" rather than a fixed hour count.

Exhibit 12 — Retention schedule

Exhibit 13 — Data-protection compliance calendar

Exhibit 14 — FLAGSHIP: Can the U.S. parent access employee and customer data, and what documentation is required?

The same operational question, answered across all four regimes. This is the deliverable the business asked for: a go/no-go read on US-parent access, the paperwork each country demands, and a traffic-light posture. All postures assume the DPF certification status of AWS and of Marea Digital, Inc. is verified before reliance; unverified DPF is treated as not available.

Bottom line. The US parent can lawfully access group employee and customer data in all four countries, but only with the right lawful basis and a valid transfer mechanism and the supporting documentation in place — not on the strength of the group relationship alone. The pivotal open item, common to Spain and Denmark, is verifying the DPF certification status of AWS (us-east-1) and of Marea Digital, Inc.: confirmed certification for the relevant data categories moves the EEA transfers to Green; absent that, the group must run on SCCs plus a documented Transfer Impact Assessment. Mexico and Brazil each require their own transfer paperwork (art. 36 contract and aviso in Mexico; an art. 33 mechanism in Brazil), and Brazil should not rest routine intra-group transfers on consent. Until these items are confirmed by qualified local counsel, the group's overall posture is Amber.

Citations referenced: GDPR arts. 5, 6, 13–14, 28, 30, 32–36, 44–49; Commission Implementing Decision (EU) 2023/1795 (EU-US Data Privacy Framework); SCC Decision (EU) 2021/914; CJEU C-311/18 (Schrems II); Spain LOPDGDD; Danish Data Protection Act (Databeskyttelsesloven); Mexico LFPDPPP (esp. arts. 8–10, 15–20, 32, 36–37) and its Regulation; Brazil LGPD (esp. arts. 6, 7, 9, 11, 18–19, 33–38, 41, 46–48). Deadlines and any ANPD-set periods must be confirmed against the current instruments before reliance.