Cross-Border Transfers

Overview

The Cross-Border Transfers component provides tools for assessing, documenting, and managing the transfer of personal data outside Nigeria. Under the NDPA 2023, transferring personal data to another country requires that adequate safeguards are in place.

Installation

Install the NDPR Toolkit package which includes the Cross-Border Transfer components:

pnpm add @tantainnovative/ndpr-toolkit

Import

Import from the main package:

import {
  CrossBorderTransferManager,
  useCrossBorderTransfer,
  validateTransfer,
  assessTransferRisk,
  isNDPCApprovalRequired,
} from '@tantainnovative/ndpr-toolkit';

Components

The Cross-Border Transfers module includes two primary components:

import { CrossBorderTransferManager, useCrossBorderTransfer } from '@tantainnovative/ndpr-toolkit';

function TransferManagement() {
  const { transfers, addTransfer, getSummary } = useCrossBorderTransfer();

  return (
    <CrossBorderTransferManager
      transfers={transfers}
      onAdd={addTransfer}
      summary={getSummary()}
    />
  );
}

API Reference

CrossBorderTransferManager Props

Types

type TransferMechanism =
  | 'adequacy_decision'
  | 'standard_clauses'
  | 'binding_corporate_rules'
  | 'ndpc_authorization'
  | 'explicit_consent'
  | 'contract_performance'
  | 'public_interest'
  | 'legal_claims'
  | 'vital_interests';

type AdequacyStatus = 'adequate' | 'inadequate' | 'pending_review' | 'unknown';

interface CrossBorderTransfer {
  id: string;
  destinationCountry: string;
  destinationCountryCode?: string;
  adequacyStatus: AdequacyStatus;
  transferMechanism: TransferMechanism;
  dataCategories: string[];
  includesSensitiveData: boolean;
  estimatedDataSubjects?: number;
  recipientOrganization: string;
  recipientContact: {
    name: string;
    email: string;
    phone?: string;
    address?: string;
  };
  purpose: string;
  safeguards: string[];
  riskAssessment: string;
  riskLevel: 'low' | 'medium' | 'high';
  ndpcApproval?: {
    required: boolean;
    applied: boolean;
    approved?: boolean;
    referenceNumber?: string;
    appliedAt?: number;
    approvedAt?: number;
  };
  tiaCompleted: boolean;
  tiaReference?: string;
  frequency: 'one_time' | 'periodic' | 'continuous';
  startDate: number;
  endDate?: number;
  status: 'active' | 'suspended' | 'terminated' | 'pending_approval';
  createdAt: number;
  updatedAt: number;
  reviewDate?: number;
}

interface CrossBorderSummary {
  totalActiveTransfers: number;
  byMechanism: Record<TransferMechanism, number>;
  byAdequacy: Record<AdequacyStatus, number>;
  pendingApproval: CrossBorderTransfer[];
  dueForReview: CrossBorderTransfer[];
  missingTIA: CrossBorderTransfer[];
  highRiskTransfers: CrossBorderTransfer[];
  lastUpdated: number;
}

Lite variant (read-only)

For read-only transfer surfaces such as compliance dashboards and transparency pages, use CrossBorderTransferManagerLite from the new /cross-border/lite subpath. It renders the same transfer list and summary as the Full component, with no Add, Edit, or Terminate affordances and — crucially — without importing the 624-row country adequacy dataset. It ships at 5.6 KB instead of 53.3 KB (an 89% saving, minified and pre-gzip). Lite reads transfer.adequacyStatus directly from each record rather than recomputing it.

import { CrossBorderTransferManagerLite } from '@tantainnovative/ndpr-toolkit/cross-border/lite';

<CrossBorderTransferManagerLite
  transfers={transfers}
  onTransferClick={(transfer) => router.push(`/cross-border/${transfer.id}`)}
/>

See the Lite vs Full Managers guide for migration notes, side-by-side examples, and the full bundle-size table.

Best Practices

• Assess First: Always complete a transfer assessment before initiating any cross-border data transfer.
• Document Safeguards: Keep records of all safeguards implemented for each transfer, including signed contractual clauses.
• Monitor Adequacy: Regularly check whether destination countries maintain their adequacy status with the NDPC.
• Data Minimisation: Only transfer the minimum personal data necessary for the stated purpose.
• Inform Data Subjects: Your privacy policy should clearly state which countries data may be transferred to and why.

Need Help?