Transfer Records

Managing Transfer Records and Documentation

Overview

Maintaining comprehensive transfer records and documentation is a foundational obligation under the GDPR and a practical necessity for demonstrating compliance with cross-border data transfer requirements. Articles 5(2) and 24 impose a general accountability obligation, while Article 30 mandates specific records of processing activities — including details of international transfers. Beyond these baseline requirements, each transfer mechanism (SCCs, BCRs, adequacy reliance, derogations) carries its own documentation expectations. This skill provides a structured approach to building, maintaining, and auditing transfer records across all mechanisms.

Transfer Register: Core Fields

Mandatory Fields per Transfer Entry

Every cross-border transfer must be documented with the following information:

Extended Fields for Specific Mechanisms

For SCC-based transfers:

For BCR-based transfers:

For adequacy-based transfers:

For Art. 49 derogation-based transfers:

Audit Trail Requirements

What Must Be Logged

The audit trail for transfer records must capture:

Audit Trail Integrity

• Each audit log entry must be immutable once created
• Entries must include a timestamp (UTC) and authenticated user identity
• The audit trail must be protected against tampering (hash chains, write-once storage, or equivalent)
• Access to the audit trail must be restricted to authorised personnel (DPO, privacy counsel, internal audit)

Documentation Packages by Mechanism

SCC Documentation Package

A complete SCC documentation package for each transfer includes:

1. Executed SCCs — Signed copy with all Annexes (I, II, III where applicable)
2. Transfer Impact Assessment — Completed TIA per EDPB 6-step methodology
3. Supplementary measures record — List of technical, contractual, and organisational measures with effectiveness assessment
4. Due diligence record — Evidence of importer assessment (questionnaire responses, certifications, audit reports)
5. Annex review log — Record of periodic reviews and updates to Annex content
6. Sub-processor management — Current sub-processor list, notification records, objection process documentation

BCR Documentation Package

1. Approved BCR text — Current version with all amendments
2. BCR member list — All entities bound by the BCRs with accession dates
3. Compliance audit reports — Internal and external audit reports
4. Training records — Evidence of BCR training for relevant personnel
5. Complaint handling log — Records of data subject complaints and resolutions
6. Update log — Record of all BCR amendments with approval dates

Adequacy Documentation Package

1. Adequacy decision reference — Link to the relevant EC decision
2. Scope assessment — Documentation confirming the transfer falls within the adequacy scope
3. Monitoring log — Evidence of monitoring developments in the destination country
4. Contingency plan — Plan for transitioning to alternative mechanisms if adequacy is revoked

Art. 49 Derogation Documentation Package

1. Derogation assessment — Written analysis of why the specific derogation applies
2. Necessity analysis — Documentation of why no alternative mechanism is available
3. Data subject information — Evidence that data subjects were informed per Art. 49(1)(e) where applicable
4. DPA notification — Copy of any notification to the supervisory authority under Art. 49(1)(2)
5. Transfer log — Detailed log of each individual transfer (for occasional transfers)

Supervisory Authority Expectations

Information to Produce on Request

Supervisory authorities expect organisations to produce the following within a reasonable timeframe (typically 2-4 weeks):

1. Complete transfer register covering all international transfers
2. Transfer mechanism documentation for any specific transfer
3. TIA documentation for transfers to non-adequate countries
4. Evidence of periodic reviews and updates
5. Audit trail for any specific transfer entry
6. Sub-processor chains for processor-based transfers
7. Records of any transfer suspensions or terminations and the reasons

Common SA Findings

Review and Governance Cycle

Annual Review Cycle

Trigger-Based Reviews

In addition to the annual cycle, reviews must be triggered by:

• Change in destination country legislation or enforcement practice
• CJEU judgment affecting transfer mechanisms (e.g., Schrems-type ruling)
• EC adequacy decision adopted, amended, or revoked
• EDPB guidance or recommendation affecting transfer documentation
• Organisational change (new entity, acquisition, divestiture)
• Data breach involving transferred data
• Supervisory authority inquiry or investigation

Athena Global Logistics — Transfer Register Example

Active Transfers (Extract)

Governance Framework

• Transfer Register Owner: Elisa Brandt, Group DPO
• Review Frequency: Quarterly (full register), plus trigger-based
• Audit Trail System: GRC platform with immutable logging
• SA Response SLA: Complete documentation package within 10 business days of request
• Escalation Path: DPO → Head of Legal → Chief Privacy Officer → Board Privacy Committee