This section captures comprehensive organizational and jurisdictional details for both data export and import entities. Accurate completion is critical for determining applicable legal frameworks and transfer mechanisms.
Data Exporter Legal Entity Name
Data Exporter Registration Number
Data Exporter Primary Contact (Full Name)
Data Exporter Contact Role/Title
Data Exporter Contact Email
Data Importer Legal Entity Name
Data Importer Registration Number
Data Importer Primary Contact (Full Name)
Data Importer Contact Role/Title
Data Importer Contact Email
Destination Jurisdiction Region Classification
European Union/European Economic Area
United Kingdom
Asia-Pacific (APAC)
Latin America (LATAM)
Middle East & Africa (MEA)
North America (non-EU)
Other Sovereign State
Destination Country/Territory Name
Does the destination jurisdiction have an adequacy decision or equivalent data protection recognition?
Applicable Transfer Mechanisms (select all that apply)
Standard Contractual Clauses (SCCs)
Binding Corporate Rules (BCRs)
Certification Mechanism (e.g., GDPR Certification)
Code of Conduct
Derogations for Specific Situations
Other Legitimate Transfer Basis
Transfer Commencement Date
Transfer Agreement Expiry/Renewal Date
Describe the Frequency and Regularity of Transfers
Estimated Number of Data Subjects Affected (per annum)
This section requires granular classification of personal data categories, volume metrics, and rigorous data minimization validation. Accurate categorization determines applicable protection levels and risk scoring.
Categories of PII Subject to Transfer (select all that apply)
Basic Identity Data (name, username, ID numbers)
Contact Information (email, phone, address)
Financial Data (payment details, transactions)
Health & Medical Data
Biometric Data
Genetic Data
Location Data & Geospatial Tracking
Online Identifiers (IP addresses, cookies, device IDs)
Behavioral & Profiling Data
Professional & Employment Data
Educational Data
Legal & Criminal Data
Children's Data (under digital consent age)
Other Special Category Data
Total Volume of PII Records (approximate count)
Total Storage Size of Transferred PII
Does the transfer include sensitive personal data requiring enhanced protection?
Data Minimization Validation Matrix: Rate the following minimization principles
Non-Compliant | Partially Compliant | Compliant | Exceeds Requirements | |
|---|---|---|---|---|
Data is adequate and limited to what is necessary for the specified purpose | ||||
Data is relevant and has a clear, documented business justification | ||||
Retention periods are defined and strictly enforced | ||||
Data accuracy mechanisms are implemented and monitored | ||||
Regular review and deletion processes are operational |
Describe the Specific, Explicit, and Legitimate Purpose(s) for Transfer
Has a Data Protection Impact Assessment (DPIA) been conducted for this transfer?
PII Category Volume Breakdown & Retention Schedule
PII Category | Number of Records | Retention Period | Scheduled Deletion Date | Automated Deletion Enabled? | |
|---|---|---|---|---|---|
Customer Identity Data | 1500000 | 7 years post-account closure | 1/1/2032 | ||
Transaction Records | 2500000 | 10 years for tax compliance | 4/15/2035 | ||
Are data subjects explicitly informed about cross-border transfer in privacy notices?
This section audits the implementation of Standard Contractual Clauses and comprehensively evaluates the Transfer Impact Assessment. Rigorous documentation is required to demonstrate lawful transfer under applicable data protection regimes.
SCC Version/Module Applicable to This Transfer
EU Commission SCCs 2021 (Modules 1-4)
UK International Data Transfer Agreement (IDTA)
Swiss Transborder Data Flow Agreement
Other Regional SCC Framework
Custom Bilateral Agreement with Equivalent Protections
Have the SCCs been fully executed and signed by both exporter and importer?
SCC Execution Date
Upload Executed SCC Document (redacted version acceptable for initial review)
Has a comprehensive Transfer Impact Assessment (TIA) been completed?
TIA Document Reference Number
Upload Complete TIA Report and Appendices
TIA Risk Factor Evaluation: Rate the level of risk identified for each factor
No Risk | Low Risk | Medium Risk | High Risk | Critical Risk | |
|---|---|---|---|---|---|
Destination jurisdiction surveillance laws and practices | |||||
Government access to data without independent oversight | |||||
Data importer's history of government data requests | |||||
Absence of data subject rights enforcement mechanisms | |||||
Conflict between local laws and SCC obligations |
Did the TIA identify any risks that cannot be fully mitigated by SCCs alone?
Supplementary Measures Implemented (select all applicable)
Enhanced Encryption (end-to-end, client-side)
Data Anonymization/Pseudonymization
Distributed/Multi-Party Computation
Zero-Knowledge Architecture
Data Residency Restrictions
Additional Contractual Obligations
Independent Compliance Audits
Data Sovereignty Framework Adoption
Has the data importer provided transparency reports regarding government access requests?
Last TIA Review/Update Date
Are there any sub-processors involved in the destination jurisdiction?
This section evaluates technical security measures, particularly encryption standards, and assesses mitigation strategies against foreign government access risks. Technical controls must be robust and demonstrably effective.
Encryption Standard for Data at Rest in Destination
AES-256 or higher
AES-128
Triple DES
Proprietary Encryption
No Encryption Applied
Encryption Protocol for Data in Transit
TLS 1.3 or higher
TLS 1.2 with strong ciphers
TLS 1.1 or lower
IPsec VPN
Unencrypted transmission
Is end-to-end encryption (E2EE) implemented where data is encrypted at source before transfer?
Encryption Key Management Location
Keys held exclusively by data exporter (customer-controlled)
Keys held by data importer in secure HSM in exporter's jurisdiction
Keys held by data importer in destination jurisdiction
Third-party Key Management Service (KMS)
No dedicated key management system
Are encryption keys stored in Hardware Security Modules (HSMs) or equivalent secure enclaves?
Key Rotation Frequency
Government Access Risk Mitigation Matrix: Rate effectiveness of each mitigation (1=Poor, 5=Excellent)
Legal framework analysis of destination jurisdiction surveillance laws | |
Technical measures preventing direct government access (e.g., no backdoors) | |
Contractual prohibitions on voluntary data disclosure to authorities | |
Transparency and notification procedures for legal requests | |
Data residency or localization strategies limiting exposure |
Has a legal analysis been conducted on destination jurisdiction's laws regarding government access to cloud data?
Describe Specific Technical and Organizational Measures to Resist Unlawful Government Access Requests
Does the data importer have a documented policy for handling government data access requests?
Additional Security Certifications Held by Importer (select all that apply)
ISO/IEC 27001:2022
SOC 2 Type II
PCI DSS Level 1
FedRAMP Authorization
National Cyber Security Scheme (e.g., Cyber Essentials Plus)
Cloud Security Alliance (CSA) STAR
No certifications held
Upload Most Recent Security Audit Report or Certification
Are data anonymization or pseudonymization techniques applied before transfer?
Final clearance requires formal attestation from designated privacy and legal authority functions. This section captures risk acceptance decisions, conditional approvals, and formal sign-off required to authorize the cross-border transfer.
Data Protection Officer (DPO) Full Legal Name
DPO Professional Certification/Accreditation
DPO Review Completion Date
DPO Risk Assessment Summary: Rate overall compliance posture
Non-Compliant | Minor Gaps | Substantially Compliant | Fully Compliant | Exemplary | |
|---|---|---|---|---|---|
Completeness and accuracy of information provided in sections 1-4 | |||||
Adequacy of technical and organizational safeguards | |||||
Effectiveness of data subject rights protection mechanisms | |||||
Robustness of breach detection and response capabilities | |||||
Alignment with data minimization and purpose limitation principles |
DPO Recommended Clearance Decision
Full Clearance Approved
Conditional Clearance Approved (with remediation)
Clearance Denied - High Risk
Escalation to Supervisory Authority Required
DPO Additional Comments and Recommendations
DPO Digital Signature and Attestation
Chief Legal Officer (CLO) or General Counsel Full Legal Name
CLO Bar Association/Professional Membership ID
CLO Legal Review Completion Date
Has CLO verified that all contractual obligations align with SCC requirements and local laws?
CLO Legal Risk Classification
Low Legal Risk - Standard Monitoring
Medium Legal Risk - Enhanced Oversight Required
High Legal Risk - Board-Level Approval Needed
Prohibited - Transfer Cannot Proceed Legally
CLO Legal Opinion Summary and Caveats
Chief Legal Officer Digital Signature and Legal Attestation
Final Clearance Authorization Date
I acknowledge that this clearance is subject to periodic review and may be revoked if compliance gaps emerge or legal frameworks change
Next Scheduled Review Date (maximum 12 months from authorization)
Upload Final Approved and Signed Transfer Agreement Package