# Cross-border data: map the transfer before choosing a mechanism

Original SecNet workpaper · 1.0 · 11 October 2026

Complete placeholders for your assessment. The example below is fictional; it is not an executed test or a legal decision.

## Assessment identity

- Record ID: [___]
- Objective and decision question: [___]
- Scope / exclusions: [___]
- Criteria and version: [___]
- Authorization and limits: [___]
- Owner / independent reviewer: [___]
- Period / artifact digest: [___]
- Evidence access / retention: [___]

## Planned procedure

1. Map personal-data categories, exporter/importer roles, storage, remote access, onward recipients and purpose. Include support access and backups, not just the primary hosting region.
2. Identify applicable privacy laws and whether the activity is a regulated international transfer. Ask the privacy/legal owner to validate scope and lawful processing separately.
3. For relevant GDPR transfers, evaluate the available transfer mechanism, such as an applicable adequacy decision or appropriate safeguards. Document the actual conditions rather than using a generic SCC label.
4. If using SCCs, select suitable modules and assess the transfer circumstances and destination-law risks. Distinguish international-transfer SCCs from controller/processor clauses for another purpose.
5. Evaluate necessary supplementary measures and their effectiveness: minimization, key control, access boundaries and contractual/organizational safeguards. Encryption is not decisive when the recipient needs plaintext.
6. Record approval, retention, onward-transfer restrictions and reassessment triggers. Test whether real technical access matches the approved transfer map.

## Evidence and decision register

| ID | Criterion | Observation | Redacted evidence / origin / time | Conclusion and limitation | Owner / date | Recheck |
|---|---|---|---|---|---|---|
| [___] | [___] | [___] | [___] | [___] | [___] | [___] |

## Topic-specific deliverables

- [ ] Transfer inventory and jurisdiction/role analysis.
- [ ] Mechanism selection and transfer/supplementary-measure assessment.
- [ ] Approval, technical verification and periodic reassessment record.

## Worked fictional decision example

Fictional service: customer records stay in an EU region, but a support team elsewhere can view them. The team maps that access, minimizes the support fields and evaluates the applicable transfer route with its privacy owner. “EU hosting” is not treated as proof that no international access exists; the access logs and support permissions are checked against the agreed design.

## Closure check

- [ ] Remote support and onward recipients included?
- [ ] Mechanism and roles reviewed for the actual jurisdiction?
- [ ] Technical measures verified and review triggers set?

## Official references · checked: 2026-10-11

- [European Commission · Standard Contractual Clauses](https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en)
- [EDPB Recommendations 01/2020](https://www.edpb.europa.eu/our-work-tools/our-documents/recommendations/recommendations-012020-measures-supplement-transfer_en)