How to Use the International Data Transfer Assessment

• Understand the Brackets: [Bold Black Brackets] = Mandatory fields you must complete (legal names, dates, assessor details). [Italic Gray Brackets] = Examples/guidance showing exactly what to write. Replace them with your actual data, or delete them if not applicable.
• Legal Review: Transfer assessments are legally binding compliance evidence. Always have qualified counsel review before approval.
• Gather Input First: Collect information from engineering, vendor management, and security teams before filling out the tables.

Before completing the assessment, clarify these points:

• Which transfers require assessment? Only transfers to countries without an adequacy decision need this documentation. If you transfer to the UK, Canada, or Switzerland, note the adequacy status and skip the risk analysis.
• What is your transfer mechanism? Are you relying on SCCs, UK IDTA, Binding Corporate Rules (BCRs), or a specific derogation? This drives the rest of the assessment.
• What is the destination country’s legal landscape? Research government surveillance laws, judicial oversight, and data subject redress mechanisms (EDPB Recommendations 01/2020).
• What supplementary measures apply? Identify technical (encryption, pseudonymization), organizational (access controls, training), and contractual (notification clauses, audit rights) safeguards you already use.

Every table includes italic gray sample text. Here’s how to use each one:

• 1Section 1: Transfer Overview
  Purpose: Maps who, what, where, and why data is moving internationally.
  Action: Replace the gray examples with your specific exporter/importer names, destination countries, data categories, and transfer volume. Keep it concise but accurate.
• 2Section 2: Destination Country Risk Assessment
  Purpose: Evaluates whether the destination country’s laws undermine EU/UK data protection standards.
  Action: Document your findings for each risk factor using the gray text as a starting point. If you lack specific legal analysis, note “Pending legal review” and consult counsel. Select the overall risk level (Low/Medium/High) based on your findings.
• 3Section 3: Supplementary Measures
  Purpose: Lists the controls you implement to mitigate identified transfer risks.
  Action: Keep only the technical, organizational, and contractual measures you actually use. Add implementation dates to prove they are active. Delete rows for controls that don’t apply to this specific transfer.
• 4Section 4: Conclusion & Approval
  Purpose: Formalizes the transfer decision and assigns accountability.
  Action: Select Approved, Approved with Conditions, or Rejected/Suspended. Write a clear rationale referencing the SCCs and supplementary measures in place. Fill in the next review date and assessor details.
• 5Signatures & Version History
  Purpose: Provides legal authorization and maintains an audit trail.
  Action: Ensure both the DPO and Legal/Compliance Lead sign with names and dates. Add a new row to the version history each time you update the assessment.

• Did you replace all [Bold Brackets] with actual company and vendor details?
• Did you update or remove all [Italic Gray Examples] to reflect your real data flows?
• Does Section 1 align with your Data Processing Agreements (PRI-004) and RoPA (PRI-001)?
• Is the destination country risk assessment supported by documented research or legal guidance?
• Do the supplementary measures in Section 3 match your actual technical and contractual controls?
• Has the overall risk level been validated by your DPO or external counsel?
• Are both approval signatures complete with names, titles, and dates?

• Execution Store the fully signed assessment in your centralized compliance evidence folder.
• Link to Vendor Records Attach it to the corresponding vendor or data importer file in your third-party risk management system.
• Reference in Documentation Link this assessment in your Privacy Notice (PRI-003), RoPA (PRI-001), and internal data mapping documentation.
• Review Cadence Reassess annually, or immediately if destination country laws change, security controls are modified, or the scope of data transfer expands.

• Document Assumptions: If you’re unsure about a country’s surveillance practices, note “Assessment based on publicly available legal guidance as of [Date]” to protect against future regulatory changes.
• Keep Supplementary Measures Realistic: Only list controls you can demonstrate during an audit. Overpromising encryption or pseudonymization without technical proof creates compliance risk.
• Use Version Control: Transfer assessments expire quickly as laws evolve. Track every update in the Version History table and re-sign material changes.
• Align with Your DPA: Ensure the transfer mechanism and supplementary measures match what’s written in the signed Data Processing Agreement (PRI-004) for that vendor.