Captures entity and jurisdictional details for data exporters and importers. Critical for determining applicable legal frameworks and transfer mechanisms.
Entity Name
Registration Number
Primary Contact Full Name
Contact Role / Title
Contact Email
Entity Name
Registration Number
Primary Contact Full Name
Contact Role / Title
Contact Email
Destination Jurisdiction Region Classification
European Union / European Economic Area
United Kingdom
Asia-Pacific (APAC)
Latin America (LATAM)
Middle East & Africa (MEA)
North America (non-EU)
Other:
Destination Country / Territory Name
Does the destination jurisdiction have an adequacy decision or equivalent data protection recognition?
Specify Adequacy Decision Reference (e.g., EU Commission Decision number, treaty reference)
Warning: Absence of adequacy decision triggers requirement for additional transfer mechanisms and comprehensive Transfer Impact Assessment (TIA). Please ensure Sections 3 and 4 are completed with heightened scrutiny.
Applicable Transfer Mechanisms (select all that apply)
Standard Contractual Clauses (SCCs)
Binding Corporate Rules (BCRs)
Certification Mechanism (e.g., GDPR Certification)
Code of Conduct
Derogations for Specific Situations
Other Legitimate Transfer Basis
Transfer Commencement Date
Transfer Agreement Expiry / Renewal Date
Describe the Frequency and Regularity of Transfers
Estimated Number of Data Subjects Affected (per annum)
Classifies personal data categories, volume metrics, and data minimization compliance. Accurate entries determine protection levels and risk scoring.
Categories of PII Subject to Transfer (select all that apply)
Basic Identity Data (name, username, ID numbers)
Contact Information (email, phone, address)
Financial Data (payment details, transactions)
Health & Medical Data
Biometric Data
Genetic Data
Location Data & Geospatial Tracking
Online Identifiers (IP addresses, cookies, device IDs)
Behavioral & Profiling Data
Professional & Employment Data
Educational Data
Legal & Criminal Data
Children's Data (under digital consent age)
Other Special Category Data
Total Volume of PII Records (approximate count)
Total Storage Size of Transferred PII
Does the transfer include sensitive personal data requiring enhanced protection?
Justify the necessity of transferring sensitive data and describe enhanced safeguards implemented
Data Minimization Validation Matrix: Rate the following minimization principles
Non-Compliant | Partially Compliant | Compliant | Exceeds Requirements | |
|---|---|---|---|---|
Data is adequate and limited to what is necessary for the specified purpose | ||||
Data is relevant and has a clear, documented business justification | ||||
Retention periods are defined and strictly enforced | ||||
Data accuracy mechanisms are implemented and monitored | ||||
Regular review and deletion processes are operational |
Describe the Specific, Explicit, and Legitimate Purpose(s) for Transfer
Has a Data Protection Impact Assessment (DPIA) been conducted for this transfer?
DPIA Reference Number/Document ID
Critical Action Required: Conduct DPIA immediately as mandated for high-risk cross-border transfers. This clearance cannot be finalized without DPIA completion.
PII Category Volume Breakdown & Retention Schedule
PII Category | Number of Records | Retention Period | Scheduled Deletion Date | Automated Deletion Enabled? | ||
|---|---|---|---|---|---|---|
A | B | C | D | E | ||
1 | ||||||
2 | ||||||
3 | ||||||
4 | ||||||
5 |
Are data subjects explicitly informed about cross-border transfer in privacy notices?
Provide immediate remediation plan to update privacy notices
Audits Standard Contractual Clauses and evaluates Transfer Impact Assessments. Complete documentation demonstrates lawful cross-border data transfer.
SCC Version / Module Applicable to This Transfer
EU Commission SCCs 2021 (Modules 1-4)
UK International Data Transfer Agreement (IDTA)
Swiss Transborder Data Flow Agreement
Other Regional SCC Framework
Custom Bilateral Agreement with Equivalent Protections
Specify Regional SCC Framework Reference
Justify equivalency of custom bilateral agreement and attach legal opinion
Have the SCCs been fully executed and signed by both exporter and importer?
Critical Blocker: SCCs must be executed before any transfer commences. Halt transfer activities immediately until signed agreements are in place.
SCC Execution Date
Upload Executed SCC Document (redacted version acceptable for initial review)
Has a comprehensive Transfer Impact Assessment (TIA) been completed?
Critical Deficiency: TIA is mandatory for transfers to jurisdictions without adequacy decisions. Complete TIA before proceeding.
TIA Document Reference Number
Upload Complete TIA Report and Appendices
TIA Risk Factor Evaluation: Rate the level of risk identified for each factor
No Risk | Low Risk | Medium Risk | High Risk | Critical Risk | |
|---|---|---|---|---|---|
Destination jurisdiction surveillance laws and practices | |||||
Government access to data without independent oversight | |||||
Data importer's history of government data requests | |||||
Absence of data subject rights enforcement mechanisms | |||||
Conflict between local laws and SCC obligations |
Did the TIA identify any risks that cannot be fully mitigated by SCCs alone?
Describe Supplementary Measures Implemented to Address Residual Risks
Supplementary Measures Implemented (select all applicable)
Enhanced Encryption (end-to-end, client-side)
Data Anonymization/Pseudonymization
Distributed / Multi-Party Computation
Zero-Knowledge Architecture
Data Residency Restrictions
Additional Contractual Obligations
Independent Compliance Audits
Data Sovereignty Framework Adoption
Has the data importer provided transparency reports regarding government access requests?
Explain how importer transparency and accountability is ensured without published reports
Last TIA Review / Update Date
Are there any sub-processors involved in the destination jurisdiction?
Sub-Processor Inventory in Destination Jurisdiction
Sub-Processor Name | Processing Activity | SCCs in Place? | Last Audit Date | Risk Rating (1=Low, 5=High) | ||
|---|---|---|---|---|---|---|
A | B | C | D | E | ||
1 | ||||||
2 | ||||||
3 | ||||||
4 | ||||||
5 |
Evaluates encryption standards and mitigations against foreign government access risks. Technical security controls must be robust and demonstrably effective.
Encryption Standard for Data at Rest in Destination
AES-256 or higher
AES-128
Triple DES
Proprietary Encryption
No Encryption Applied
Encryption Protocol for Data in Transit
TLS 1.3 or higher
TLS 1.2 with strong ciphers
TLS 1.1 or lower
IPsec VPN
Unencrypted transmission
Is end-to-end encryption (E2EE) implemented where data is encrypted at source before transfer?
Describe E2EE implementation architecture and key management
Encryption Key Management Location
Keys held exclusively by data exporter (customer-controlled)
Keys held by data importer in secure HSM in exporter's jurisdiction
Keys held by data importer in destination jurisdiction
Third-party Key Management Service (KMS)
No dedicated key management system
Are encryption keys stored in Hardware Security Modules (HSMs) or equivalent secure enclaves?
Justify alternative key storage method and describe security controls
Key Rotation Frequency
Government Access Risk Mitigation Matrix: Rate effectiveness of each mitigation (1=Poor, 5=Excellent)
Legal framework analysis of destination jurisdiction surveillance laws | |
Technical measures preventing direct government access (e.g., no backdoors) | |
Contractual prohibitions on voluntary data disclosure to authorities | |
Transparency and notification procedures for legal requests | |
Data residency or localization strategies limiting exposure |
Has a legal analysis been conducted on destination jurisdiction's laws regarding government access to cloud data?
Upload Legal Opinion on Government Access Laws
Describe Specific Technical and Organizational Measures to Resist Unlawful Government Access Requests
Does the data importer have a documented policy for handling government data access requests?
Provide remediation plan to develop and implement such policy
Additional Security Certifications Held by Importer (select all that apply)
ISO / IEC 27001:2022
SOC 2 Type II
PCI DSS Level 1
FedRAMP Authorization
National Cyber Security Scheme (e.g., Cyber Essentials Plus)
Cloud Security Alliance (CSA) STAR
No certifications held
Upload Most Recent Security Audit Report or Certification
Are data anonymization or pseudonymization techniques applied before transfer?
Detail anonymization/pseudonymization methodology and validate irreversibility
Final clearance needs formal privacy / legal attestation, capturing risk acceptance, conditional approvals, and required sign-off for cross-border transfer.
Full Name
Professional Certification / Accreditation
Review Completion Date
Risk Assessment Summary: Rate overall compliance posture
Non-Compliant | Minor Gaps | Substantially Compliant | Fully Compliant | Exemplary | |
|---|---|---|---|---|---|
Completeness and accuracy of information provided in sections 1-4 | |||||
Adequacy of technical and organizational safeguards | |||||
Effectiveness of data subject rights protection mechanisms | |||||
Robustness of breach detection and response capabilities | |||||
Alignment with data minimization and purpose limitation principles |
Recommended Clearance Decision
Full Clearance Approved
Conditional Clearance Approved (with remediation)
Clearance Denied - High Risk
Escalation to Supervisory Authority Required
List All Conditions and Remediation Actions with Target Completion Dates
Detail Specific High-Risk Factors Preventing Approval
Explain necessity for regulatory consultation and next steps
Additional Comments and Recommendations
Data Protection Officer (DPO) Signature
Full Name
Bar Association / Professional Membership ID
Review Completion Date
Has CLO verified that all contractual obligations align with SCC requirements and local laws?
Describe Legal Conflicts and Proposed Resolution Strategy
Legal Risk Classification
Low Legal Risk - Standard Monitoring
Medium Legal Risk - Enhanced Oversight Required
High Legal Risk - Board-Level Approval Needed
Prohibited - Transfer Cannot Proceed Legally
Legal Opinion Summary and Caveats
Chief Legal Officer Signature
I acknowledge that this clearance is subject to periodic review and may be revoked if compliance gaps emerge or legal frameworks change
Next Scheduled Review Date (maximum 12 months from authorization)
Upload Final Approved and Signed Transfer Agreement Package
To configure an element, select it on the form.