File transfer & data protection 101: your map to global regulations

In 2017, the Economist ran a headline which read “the world’s most valuable resource is no longer oil, but data.”

Looking back, it may seem radical. But those were the days when much of the public was beginning to awaken to the power of data – I remember hearing a dystopian fact during this time about how Google would know a woman is pregnant before she does, based on her search engine interactions.

It was also during this time that national governments were making moves to curb the risks posed by the wielding of such data.

One of the most famous, which was the inspiration for many others that followed, was the GDPR (General Data Protection Regulation). A regulation which was so bold, it resulted in a shift in business risk appetite that still causes a shudder among information security teams today.

GDPR’s impact on data transfer technology

Today, we have moved on. We have come to accept that international businesses have international obligations, and that countries, regions and territories all come with webs of regulations which we must navigate.

In fact, the pace of regulation has been so swift that there is a growing countermovement to slash red tape and simplify business operations in the face of slowing economies.

Businesses of all industries and sizes are now operationally reliant on the flow of data around their business, with file transfer technologies right in the middle. Exchanging that risky lifeblood that powers everything from payments to stock fulfilment, to manufacturing everyday goods, between applications, servers and trading partners.

Alongside marketing automation platforms, financial software and healthcare databases, MFT finds itself subject to the highest levels of regulation for the types and quantities of data which it processes.

But which ones are you and your file transfer solution subject to?

Given that a single non-compliant file transfer containing sensitive financial transactions, personal health records, or government data can result in millions in penalties, devastating reputational damage, and severe operational disruptions, it’s a question your organization needs to be able to answer.

With this context in mind, here’s a brief overview of the various regulations your file transfer ecosystem may need to comply with.

European data regulation landscape

Europe didn’t have first-mover advantage when it came to data protection regulations, but it certainly made an impact when it arrived – for the second time.

Possibly one of the most heavily regulated regions of the world, the European Union has led the way in modern data regulations. Today, there are several regulations which businesses need to be aware of:

• The General Data Protection Regulation (GDPR)
• The Network and Information Security Directive (NIS2)
• Digital Operational Resilience Act (DORA)
• The Financial Data Access Regulation (FiDA)

The regulations above can be broadly split into two categories:

• GDPR and FiDA are both concerned with the data that’s being processed by file transfer solutions, its use and its protective controls.
• DORA and NIS2 are less concerned with data and more with the availability and reliability of file transfer processing systems.

With much overlap between all of them, the overarching theme is one of risk assessment and risk reduction via mitigating controls.

Some have specific clauses to beware of however, such as the GDPR’s data subject rights and its application to any business in the world which interacts with the data of data subjects who reside in the EU.

Data privacy and security legislation in North America

Data protection regulations can be tricky in North America, with a patchwork of state/provincial, federal legislation, and industry specific rules at play:

• Health Insurance Portability and Accountability Act (HIPAA)
• Personal Information Protection and Electronic Documents Act (PIPEDA)
• Cybersecurity Maturity Model Certification (CMMC)
• Gramm-Leach-Bliley Act (GBLA)
• Sarbanes-Oxley Act (SOX)
• Federal Law for the Protection of Personal Data in the Possession of Private Parties (LFPDPPP) – Mexico
• General Law for the Protection of Personal Data in Possession of Obligated Subjects (GLPPDPOS) – Mexico

In the U.S. specifically, while there is no federal comparison to the GDPR, state-led regulations have become the norm with 14 states having regulations in place – at time of writing – and another six planning to adopt regulation in 2025 or 2026.

See also: Axway Solutions for the U.S. Federal Government

Due to this fragmentation and overlaps with federal trade laws, it can sometimes be more challenging for file transfer activities to remain compliant in North america than globally. For businesses that span states, countries, and are in regulated industries, it can be a minefield.

CommonSpirit Health, one of the largest nonprofit hospital chains in the U.S., relies on Axway’s MFT solution for secure data exchange within its on-premises healthcare environment. While fast-tracking innovation, CommonSpirit Health has a framework to protect sensitive data.

Central & South American data protection regulation

Although not all, once again GDPR’s influence has been profound in regions such as Central and South America. With many countries enacting similar legislation – sometimes for classification as a “– or legislation which seeks to localize and improve the GDPR for the Latin American market and customs.

Some of the more noteworthy and active regulations include:

• Lei Geral de Proteçao de Dados (LGPD) – Brazil
• Personal Data Protection Law (PPDL) – Argentina

With countries such as Chile and Columbia currently in the throes of updating existing laws and having them pass through the various chambers of government.

Alignment with existing legislation makes compliance in this region much easier. There are however slight differences in breach reporting requirements, registration and penalties, which should all be paid attention to.

Data laws of Asia & the Pacific

Most businesses would be forgiven in any other aspect for lumping this region into one block, however the expanding number of countries introducing data protection and privacy laws is making it ever challenging.

Here are just some of examples from an extensive list:

• The Australian Privacy Act (APA) – Australia
• Consumer Data Rights (CDR) – Australia
• Australian Prudential Regulation Authority (APRA) Prudential Standard 234 (CPS 234)
• Personal Information Protection Law (PPL) – China
• The Digital Personal Data Protection Act (DPDP) – India
• The Personal Data Protection Act (PDPA) – Malaysia
• Personal Data Protect Act (PDPC) – Singapore
• Decree on Personal Data Protection – Vietnam

Again, some legislation predates its European equivalent, while most have been created in the image of or updated by way of inspiration.

Importantly, countries with very large populations and consumer bases such as China, Vietnam, and India have rejected legal processing routes such as legitimate interests – a clause heavily relied upon by U.S. and European marketing teams.

Also noteworthy is the requirement for local language notification and in some cases, the topic of data sovereignty raises its head in the form of cross-border transfer restrictions.

See how leading companies get peace of mind with secure, standard-based file data integration

Regulation in the Middle East & Africa

Data protection in the Middle East and Africa is evolving, with some regions reliant on general provisions from previous legislation and others enacting GDPR-inspired regulations. In Africa, the African Union created the Malabo Convention to encourage members to develop domestic laws on data protection.

• Personal Data Protection Law (PDPL) – Saudi Arabia
• Federal Data Protection Law – UAE
• The Protection of Personal Information Act (POPIA) – South Africa
• The Personal Data Protection Act – Tanzania

The patchwork of this region can be particularly challenging. The Middle East is more developed in this space but exemptions in Free Zones, lack of unity, and insistence on data sovereignty in small regions can restrict some businesses from operating effectively, or at all.

In Africa, lack of strength from supervisory authorities in enforcement has led to inconsistency in application.

See also: The File Transfer Breach Crisis: Lessons for MFT Security

How to remain complaint in shifting sands

If you are still reading this article and not completely overwhelmed by the myriads of regulation and compliance requirements for international businesses, well done. You have likely understood that while the names of regulations differ, and there are some variations to their provisions, it is largely true that there is uncoordinated alignment across the world.

While the GDPR isn’t perfect – and there is even a move to simplify it – most post-2018 regulations have their roots connected to it. Much in the way that many European languages stem from Latin, most data protection legislation appears to stem from the GDPR.

So how do we, broadly speaking, remain compliant while performing file transfers between applications, servers and trading partners, while not being experts?

My recommendation is that it all comes down to a risk-based approach. Wherever we feel that our file transfer and processing activities could involve a level of risk to the data owner, we should be taking documented steps to reduce that risk. A simple example being to encrypt said data at all stages of its existence.

While this doesn’t necessarily satisfy all requirements of the regulation you are subject to, it does speak to the spirit of the regulation – which after all, is the reason it was created in the first place.

Maintain global compliance with Axway MFT

Axway has been a trusted provider for decades and supports today’s customers across all industries as the volume and sensitivity of B2B file transfers are rising and the number of ransomware attacks explodes.

We have a uniquely solid history of supporting clients in achieving global regulatory compliance, providing expert guidance on best practices and a steadfast commitment to data integration security.

It’s one reason Textron – a company with a global network of aerospace, defense and intelligence, industrial, and financial businesses – relies on Axway MFT to support more than six million transactions a year.

By embracing our managed services in the cloud, the organization gains better confidentiality, integrity, and availability controls, such as security with 24/7 file tracking for every file transfer, with automated alerting for delivery failures, responsive technical support available around the clock, and access to our pedigree of expertise.