The policy authorizes transfer of personal information to Walt Disney Family of Companies entities and third parties located anywhere in the world, stating that standard contractual clauses, consent, or other lawful transfer mechanisms will be used where applicable.
This analysis describes what Disney+'s agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes the legal transfer mechanisms Disney intends to rely upon for cross-border personal information flows, specifically naming standard contractual clauses (SCCs) and consent as mechanisms, which are recognized under GDPR and UK GDPR for transfers to non-adequate third countries. The adequacy of the transfer mechanisms in practice depends on operational implementation and destination country context.
Interpretive note: The specific transfer mechanisms applied to particular cross-border data flows are not identified in the policy, and the reference to 'other lawful means' requires operational context to assess adequacy under applicable law.
Under this clause, personal information may be transferred to and processed in countries outside the user's country of residence, including countries that may not have equivalent data protection frameworks, with Disney stating it will apply standard contractual clauses, consent, or other lawful transfer mechanisms to safeguard the information.
Cross-platform context
See how other platforms handle Global Data Transfer and Cross-Border Processing and similar clauses.
Compare across platforms →"We operate globally and may transfer your personal information to individual companies of The Walt Disney Family of Companies or third parties in locations around the world for the purposes described in this privacy policy. Wherever your personal information is transferred, stored or processed by us, we will take reasonable steps to safeguard the privacy of your personal information. These steps may include implementing standard contractual clauses where recognized by law, obtaining your consent, or other lawful means of transferring personal information.Excerpt from Disney+'s Walt Disney Company Privacy Policy
1) REGULATORY LANDSCAPE: This provision directly engages GDPR Chapter V (transfers to third countries), UK GDPR transfer requirements, and Brazil's LGPD transfer provisions.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This provision establishes the legal transfer mechanisms Disney intends to rely upon for cross-border personal information flows, specifically naming standard contractual clauses (SCCs) and consent as mechanisms, which are recognized under GDPR and UK GDPR for transfers to non-adequate third countries. The adequacy of the transfer mechanisms in practice depends on operational implementation and destination country context.
Under this clause, personal information may be transferred to and processed in countries outside the user's country of residence, including countries that may not have equivalent data protection frameworks, with Disney stating it will apply standard contractual clauses, consent, or other lawful transfer mechanisms to safeguard the information.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Disney+.