External parties and transfers

Perform a transfer impact assessment

Assess the context, the safeguards, the risks and the supplementary measures, and conclude whether the transfer is approved, restricted, remediated or refused.

Standard contractual clauses alone are not enough once the destination country's laws are considered; the transfer impact assessment is where the destination's legal regime, the safeguards actually in force and any supplementary technical measures are weighed together.

This is exercised alongside the transfer record itself, as a separate document that can be revised as the legal landscape in the destination country changes, without touching the transfer record it supports.

The proof is that a transfer relying on standard clauses with no assessment is caught as a gap, and that the conclusion carries an author, an approver and a date.

Regulation

Articles 44 and 46

Registers

Document · Transfer record · Entity · Measure · Risk

The steps

1. 01Open the Documents register and use the plus button beside the register title to create a document of the transfer impact assessment type.
2. 02Record the destination country's law and the safeguard relied upon on the Details tab.
3. 03Record any supplementary measures applied.
4. 04Write the reasoned conclusion: approved, restricted, remediated or refused.
5. 05Open the Linked records band and use "Link a record" to attach the transfer it assesses.
6. 06Move the document from Draft to Approved on the lifecycle bar, naming the approver and the date.