What evidence do auditors commonly ask for on A.1.5.4 Records of transfer of PII?

Transfer log covering transfers both to and from third parties; Documented cooperation arrangements supporting later individual requests; Retention policy for the transfer records themselves; Evidence of minimisation applied to the content of those records.

What is the most common gap auditors find on A.1.5.4?

Only outbound transfers recorded, so data flowing back after a third party correction is untracked

ISO/IEC 27701:2025 · Annex A Table A.1 PIMS controls for PII controllers

`A.1.5.4` Records of transfer of PII

The organization must keep a record of personal data it sends to, or receives from, third parties, and must work with those parties so that later requests linked to its obligations to individuals can be handled. This covers data returned by third parties after being changed as controllers meet their obligations, and data sent to third parties to carry out valid individual requests, such as deletion after consent is withdrawn. The organization must have a policy setting how long these records are kept, and must minimise their content so that only what is strictly necessary is held.

Source: ISO/IEC 27701:2025, A.1.5.4. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open ISO/IEC 27701:2025 in the compliance library.

artefacts

held by a system

at each review

moderate

to go live

SIEM / log platform

where the evidence lives

teal = a system already holds it · olive = produced at each review. To go live: easy when half or more of the artefacts are already held by a system, moderate from a quarter to a half, hard below a quarter.

These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.

system holds itEvidence a system already holds

Transfer log covering transfers both to and from third parties · SIEM / log platform

periodic reviewEvidence produced at each review

Evidence of minimisation applied to the content of those records · Document repository

governing documentDocuments that govern the control

Documented cooperation arrangements supporting later individual requests · Document repository
Retention policy for the transfer records themselves · Policy repository / GRC workspace

First move

Start with the 1 of 4 artefacts that already live in a system (SIEM / log platform); keep the periodic reviews but log each one as a dated record with a named reviewer.

Common gaps auditors find

Only outbound transfers recorded, so data flowing back after a third party correction is untracked
Transfer records retained indefinitely, becoming a personal data holding of their own
Records containing the transferred data rather than a reference to it, which is the opposite of minimisation
Cooperation assumed rather than agreed, so a later erasure request cannot be propagated
Logs kept per system, with no way to answer what was transferred about one individual

Do this for your whole sheet

Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.

Build my evidence sheet

A.1.5.3 Countries and international organizations to which PII can be transferred · A.1.5.5 Records of PII disclosures to third parties