Governs cross-border transfers of personal data — adequacy, appropriate safeguards (SCCs/BCRs), consent and risk assessment.