7.5.2 Countries and international organizations to which PII can be transferred
The organization must specify and document the countries and international organizations to which personal data can possibly be transferred, making those identities available to customers and including the countries aris
5
artefacts
0
held by a system
1
at each review
hard
to go live
Document repository
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Evidence the list is made available to customers · Document repository
governing documentDocuments that govern the control
- Documented list of destination countries and international organizations · Document repository
- Inclusion of destinations arising from subcontractors, not the organization's own operations alone · Document repository
- Reconciliation between the destination list and the transfer bases held · Document repository
- Process for maintaining the list as subcontractors and regions change · Document repository
First move
This control is evidenced by people and documents, not systems. Put the document under version control with an owner and review date, and log each review as a record with reviewer and date. Do not try to automate it.
Common gaps auditors find
- List covering the organization's own locations while subcontractor destinations are omitted, which is where most undisclosed transfers arise
- List produced at contract signature and never updated as the supply chain changes
- Support and administration access from a country absent from the list, because access is not thought of as transfer
- List published without reconciliation to transfer bases, so a destination appears with no lawful route
- Availability to customers asserted but the list held internally only
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet7.5.1 Identify basis for PII transfer between jurisdictions · 7.5.3 Records of transfer of PII