Transfer requirement

Transfer of personal data to a third party in a foreign country requires prior opt-in consent that identifies the receiving country, unless the destination is on the adequacy allow-list or the recipient maintains equivalent measures.

Router behaviour

Requests bound to JP run in Japanese regions. A provider without Japanese capacity cannot serve the request, regardless of price.

Transfer requirement

Cross-border transfer generally requires the data subject's consent, with disclosure of the recipient, purpose and retention; certification and adequacy routes exist for qualifying transfers.

Router behaviour

Requests bound to KR run in Korean regions. If a model has no Korean endpoint, the request fails closed and the gap is reported as a coverage fact.

Transfer requirement

An overseas recipient must be bound to a standard of protection comparable to the Act's, in practice through a legally binding instrument such as the ASEAN model contractual clauses or binding corporate rules accepted under the trustmark route; this obligation is contractual rather than approval-based.

Router behaviour

Requests bound to SG run in Singapore regions. The contractual route governs liability, while in-country routing governs where the bytes actually rest.

Transfer requirement

Personal data may not be transferred outside Malaysia unless the destination affords a comparable level of protection or a listed exception applies; whitelist, consent and contractual routes are used in practice, and the cross-border provisions were tightened by the 2024 amendment.

Router behaviour

Requests bound to MY run in Malaysian regions when capacity exists. If it does not, the request is refused rather than sent to a neighbouring region.

Transfer requirement

There is no blanket prohibition on cross-border transfer. The data user must take all reasonable precautions and exercise due diligence that the data is not exposed to unauthorised or accidental access abroad.

Router behaviour

Requests bound to HK run in Hong Kong regions. The decision records the duty of care instead of assuming it from a provider's name.

Transfer requirement

International transfer may be restricted or prohibited where it would prejudice national interests or where the recipient's protections are inadequate; sectoral rules add further constraints.

Router behaviour

Requests bound to TW prefer Taiwanese regions. If no in-country option exists, a foreign endpoint is refused.

Transfer requirement

Cross-border transfer of personal information requires one statutory mechanism, a CAC security assessment, standard-contract filing, or certification, together with separate consent and a personal-information protection impact assessment; exemptions cover limited-volume and non-personal scenarios.

Router behaviour

Requests bound to CN run only through providers operating inside mainland China. If no in-country endpoint serves the requested model, the request is refused rather than routed abroad.

Transfer requirement

No single federal transfer regime; obligations arise from sector rules and state law. US in-region routing is offered for parity with the incumbent, not as the product's differentiator.

Router behaviour

Requests bound to US are decrypted and processed in US regions, where only US-running providers are eligible.

Transfer requirement

Transfers outside the EEA require an adequacy decision or appropriate safeguards such as standard contractual clauses, with a transfer impact assessment.

Router behaviour

Requests bound to EU run in EEA regions only.