Cross‑border data transfers: strategies that stand up to regulatory scrutiny