8.5.1 Basis for PII transfer between jurisdictions
The organization must inform the customer in a timely manner of the basis for transfers of personal data between jurisdictions and of any intended changes, so the customer can object or terminate, documenting compliance
5
artefacts
0
held by a system
2
at each review
hard
to go live
Document repository
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Notification records for changes, with the agreed advance timeframe · Document repository
- Evidence the customer had a real opportunity to object · Document repository
governing documentDocuments that govern the control
- Documented transfer basis per route, disclosed to the customer · Document repository
- Contract terms setting the limits of any change made without notification · Vendor register / contract repository
- Identification of the transfer instruments, the countries and the circumstances in which each applies · Document repository
First move
This control is evidenced by people and documents, not systems. Put the document under version control with an owner and review date, and log each review as a record with reviewer and date. Do not try to automate it.
Common gaps auditors find
- Change notification given after the change took effect, removing the ability to object
- Contractual allowance to change without notice drawn so broadly that the customer effectively waives the control
- Transfer instruments named generically without saying which country each covers
- Remote support access from another jurisdiction not treated as a transfer, so it is never disclosed
- Notification sent to a commercial contact who has no privacy remit
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet8.4.3 PII transmission controls · 8.5.2 Countries and international organizations to which PII can be transferred