Cross‑border data transfers: a practical framework to minimise regulatory exposure