A transfer-specific evidence file, safeguards decision and reassessment triggers.
STAGE 01
Map actual transfers
Record exporter and importer roles, purposes, data categories, locations, subprocessors and onward transfers. Include remote support access, administrative access and key access, not only the hosting region. Confirm whether the GDPR Chapter V transfer rules apply to the arrangement. Use synthetic examples, not real identifiers, in working templates.
Evidence to keep: Transfer map; importer roles; onward-access inventory.
STAGE 02
Select the legal route
Check an applicable adequacy decision, or an appropriate Article 46 safeguard such as SCCs or approved BCRs. Select the correct SCC module and complete its annexes. Do not treat occasional Article 49 derogations as a routine outsourcing solution. Verify current scope, conditions and status of the route.
Evidence to keep: Chosen route; applicable module; completed annexes.
STAGE 03
Assess law and practice
For a transfer relying on SCCs, assess relevant destination-country laws and practices, access powers, safeguards and remedies against the particular transfer. Use reliable current evidence and qualified advice where needed. A supplier’s statement that it has never received an access request is not a complete assessment.
Evidence to keep: Sources; legal analysis; importer evidence; uncertainties.
STAGE 04
Test supplementary measures
Ask who can see intelligible data and who controls the keys. Encryption at rest or in transit may not protect against access where the importer must process plaintext or holds the keys. Evaluate effective pseudonymisation with separately held information, access minimisation and supplementary contractual or organisational controls. Assess whether the measures address the identified problem in practice.
Evidence to keep: Threat-specific controls; key separation; effectiveness evidence.
STAGE 05
Make and document the decision
If necessary effective safeguards cannot be achieved, do not assume a signature solves the issue. Consider redesign, another lawful route, suspension or not proceeding. Obtain an accountable decision and any required formalities. Risk acceptance cannot authorise an unlawful transfer.
Evidence to keep: Decision; approver; conditions; suspension triggers.
STAGE 06
Reassess material changes
Monitor changes in law, requests for access, recipients, subprocessors, purposes and technical controls. Keep sources and dates traceable and set review triggers. A TIA supports a transfer decision; it does not certify a whole country or vendor.
Evidence to keep: Review owner; next review; change and request log.