Objective: The company is aware of and secures data transfers to third countries.
Requirements (must): Transfers to third countries are known and systematically recorded.
- e.g. through corresponding documentation in the processing directory
Sufficient guarantees (Chapter V GDPR, consideration of decisions of the ECJ on international data transfer, Transfer Impact Assessment in case of relevance, especially in the role of data exporter) are available for data transfers.
In the case of data transfers to third countries, it is determined whether the consent of the person responsible is to be obtained for each transfer to third countries.
The organization should record transfers of personal data to and from third parties. The organization should also ensure the cooperation of the relevant parties in order to enable the implementation of requests regarding obligations related to data subjects in the future as well.
The principle of data minimization must be taken into account in recordings concerning transfers and only the information that is actually needed must be kept.
The organization has identified possible transfers of personal data between jurisdictions.
There are identified and documented legal bases for transfers of personal data between jurisdictions.
GDPR defines the conditions for the lawful transfer of personal data outside the EU or the EEA.
The organization shall document all data transfers and the applicable transfer criteria. Data transfers can occur, for example, based on the location of the data system, the data processing partner or the recipient of the data disclosure.
Elevate Your Knowledge with Exclusive Access to Weekly Webinars, Video Courses, Help Articles, and Blogs.
