Do cross-border data rules apply to an online marketplace?
Short answer
Yes when buyer records reach support, fraud or analytics teams outside the EU or outside China. The route is chosen per destination and per volume, not per company.
Read against the registers 2026-08-26.
Who the role is
A platform where a third party sells to a buyer: the platform carries duties of its own, next to the seller's.
What the topic covers
Moving records across a border is where the three regimes separate most. The EU relies on adequacy and contractual safeguards. China runs an assessment and filing route with volume thresholds. The United States has no single federal transfer rule.
The rows behind the answer
European Union
- GDPR — Regulation (EU) 2016/679: Chapter V allows a transfer on adequacy, standard contractual clauses or another named safeguard.
United States
- California Consumer Privacy Act, as amended by the CPRA: No general export restriction. Service provider contracts carry the duty instead of a transfer mechanism.
China
- Measures for the Security Assessment of Outbound Data Transfers: A security assessment by the regulator is required above the stated volume and category thresholds.
- Measures on the Standard Contract for Outbound Transfer of Personal Information: A filed standard contract is the route below the assessment thresholds, with an impact assessment attached.
- Provisions on Facilitating and Regulating Cross-border Data Flows: Names exemptions where neither the assessment nor the standard contract route is required.
Where companies usually start
- Draw the actual route of the records, including subprocessors and support access.
- Count the Chinese volume thresholds before choosing between the assessment and the contract route.
- Attach the transfer assessment to the contract, not to a separate slide deck.
This page reads published registers and describes common practice. It is not legal advice and it is not a compliance verdict.
Other questions for online marketplace
- Do ai governance rules apply to an online marketplace?
- Do personal data rules apply to an online marketplace?
- Do cybersecurity rules apply to an online marketplace?
- Do health data rules apply to an online marketplace?
- Do online platforms rules apply to an online marketplace?
- Do consumer rights rules apply to an online marketplace?
- Do product safety rules apply to an online marketplace?
- Do climate disclosure rules apply to an online marketplace?
- Do export controls rules apply to an online marketplace?
ExploreWorldAI is operated by Valkiv Ventures AB (Reg. no. 556995-1311), Kungsgatan 8, 111 43 Stockholm, Sweden. EU-hosted, with data processing assessed against the GDPR. Contact: hello@exploreworldai.com.
Machine-readable summaries for AI agents: /llms.txt and /llms-full.txt.
