Guidance: International Data Transfers

Introduction

The following guidance and decision matrix has been established to assist faculty, staff, and students in the planning process for the transfer of data or sharing of information with an international recipient. This guidance has been established to advise on the proper procedures to ensure compliance with Export Control regulations and requirements as defined in the Lehigh University Export Control Compliance Manual.

The transfer of data, information, or other intangible item(s) to a destination outside of the United States (“international”) is considered an Export. Examples include, but are not limited to, software item(s), data sets, information, training manuals, documents, know-how, etc. These requirements apply regardless of whether the item(s) are sold, used for collaborative or individual research, loaned, donated, or shared with an entity or individual outside of the U.S., even if only temporarily or to perform certain tasks related to a research project.

All international transfers of software item(s), data sets, information, training manuals, documents, know-how, etc. or other intangible items must be reviewed prior to transfer to ensure that a license is not required and that items are not being exported to a denied or restricted entity or individual. Export Control laws and regulations may require that Lehigh University obtain a license for the export of certain items. The Office of Research Integrity (ORI) will assist you in assessing the need for a license and in preparing and filing required export and data transfer documentation.

Restricted Party Screening

The initial step in the process is to contact the Office of Research Integrity to perform restricted party screening. Restricted party screening is required for all international transfers regardless of data type or international destination(s). Please allow at least 5-7 Business Days for review and response before engaging in the planning and transfer of the information. Contact the Office of Research Integrity to request restricted party screening of the entity or individual recipient and/or end-user.

Decision Matrix

The next step in the process is to review the decision matrix. After the restricted party screening has been completed by ORI, please use the following matrix to determine whether the information can now be transferred or if further review is required by the Office of Research Integrity. When reviewing the decision matrix it will be helpful to have the following information available:

Complete description of the information to be transferred internationally, including use, intent, and purpose of the international transfer
If applicable, Export Control Classification Number (ECCN) or United States Munitions List (USML) Category, if available (ECCNs and/or USML Categories can often be found on manufacturer’s websites or by contacting the manufacturer directly) (note that data will not have an ECCN or USML number)
Country of destination
Name of recipient or end-user of data / information, including the name of the individual and the entity with which they are affiliated or employed
Method of transfer to be used
Whether the item is connected to the performance of an external sponsored research award, and if so, the sponsor agency name and award number

The decision matrix is intended to collect information from the sender (faculty, staff, or students) and self-certify about the “who, what, when, where, and how” of the international transfer.

If the answer to all of the questions below are NO, the individual may proceed with the international transfer. If the answer to any of the questions below are YES, the individual must email the information to the Office of Research Integrity at inexport@lehigh.edu for further review.

International Transfer Decision Matrix	Does the international transfer of this information need further review?
International Transfer Decision Matrix	YES; contact the Lehigh Office of Research Integrity	NO; proceed with transfer
Did Restricted Party Screening performed for this shipment result in a match?	Yes	No
Does the data set contain HIPAA or PII related data points or encrypted data?	Yes	No
Is the item being shared a software application?	Yes	No
Does the item have an Export Control Classification Number (ECCN) or USML Category?	Yes	No
Is the data or information subject to export controls or confidentiality obligations under the terms and conditions of any applicable agreement?	Yes	No
Do you have any other reason to believe the data or information is subject to export controls, such as through communication with a research sponsor or other third party?	Yes	No
Is the transfer destination on the list of sanctioned countries found here?	Yes	No
Could the end use have implications for military or space application?	Yes	No
Is there any indication that the usage of the data / information could compromise United States national security or foreign policy goals, regardless of the stated use?	Yes	No
Is the data / information owned by a third-party (not Lehigh)?	Yes	No
Is transfer of the data / information connected to the performance of an external sponsored research project (e.g. DOE, DOD, DARPA)?	Yes	No

Record Retention for International Transfers

All records, including emails and expense receipts, associated with any international transfer must be retained as required by the applicable export control regulations for a period of five (5) years from the date of transfer.