Transfers Outside the Jurisdiction
The row most often left blank in the record of processing, and the one most likely to be true without anybody having noticed.
TRANSFER RECORD
One row per supplier that moves data out
- SupplierNamedIncluding where the transfer is only support access
- What goesCategories of staff dataOften more than the service appears to need
- WhereCountry, and whether hosting or accessSupport from another country is a transfer
- MechanismAdequacy decision, standard clauses, or otherThe clause set must be the current version
- AssessmentWhether the destination offers equivalent protectionRequired in several regimes, rarely done
- Supplementary measuresEncryption, access limits, what elseWhere the assessment identifies a gap
- Sub-processor transfersTheirs, not just yoursThe chain moves data too
- ReviewedDateHosting locations change without notice
Most employers believe they do not transfer staff data outside their jurisdiction. Most of them do, through a supplier they have not examined.
The supplier test in “Transfers Outside the Jurisdiction” should cover the real data flow, not only the contract summary. Organisations considering a practical route to time tracking with screenshots for time tracking with screenshots should document hosting, subprocessors, permissions, deletion and export before rollout, then verify those controls during renewal and exit.
Where the transfers actually are
Hosting. A system whose data sits in another region, which the supplier may describe as a global platform.
For a separate benchmark relevant to “Transfers Outside the Jurisdiction”, consult the Google Security Blog. Use it to test purpose, data flow, retention, access and response procedures rather than substituting a generic checklist for the organisation’s actual records.
Support access. A help desk in another country able to view records. Viewing is a transfer, even where the data never moves.
Sub-processors. Your supplier's supplier, in a third country.
Backup and disaster recovery, which frequently sits somewhere different from the primary.
Group companies, where a parent in another country accesses staff records.
Each is a transfer and each needs a mechanism.
Why the record says no
Because nobody asked. The question on the form is answered by whoever filled it in, from the assumption that the supplier is local because the invoice is.
Asking the supplier directly — where is the data, where is support, who are your sub-processors and where are they — produces a different answer in a substantial share of cases.
The mechanisms
Where the destination has been assessed as offering adequate protection, the transfer can proceed on that basis.
Otherwise, standard contractual clauses or an equivalent are needed, in their current form — older versions have been superseded in several regimes and an outdated clause set is not a valid mechanism.
The assessment that goes with them
Several regimes now require a judgement about whether the destination actually provides equivalent protection in practice, considering local law and access by authorities.
Where the answer is no, supplementary measures are required: encryption with keys held locally, access restrictions, contractual commitments.
This is the step almost universally skipped. Signing the clauses is treated as the whole of the obligation and it is the beginning of it.
Group companies
An employer with a parent abroad usually shares staff data with it, and usually treats that as internal.
It is a transfer between separate legal entities and needs a mechanism like any other, plus a basis for the sharing in the first place.
What to do
Ask every supplier the four questions, in writing, once.
Most will answer within a week. The answers populate the transfer row that is currently blank, and in two or three cases they will surprise you.
Support access is a transfer
A help desk in another country able to view records is a transfer even where no data moves. It is the category most often missed, because the question is asked about hosting and answered about hosting.
The assessment beyond the clauses
Several regimes now require a judgement about whether the destination offers equivalent protection in practice. Signing the clauses is treated as the whole obligation and is the beginning of it.
Group companies are transfers too
An employer with a parent abroad usually shares staff data and treats it as internal. It is a transfer between separate legal entities and needs a mechanism like any other.
Four questions, one email
Where is the data, where is support, who are your sub-processors, where are they. Most suppliers answer within a week, and in two or three cases the answer will surprise you.
Why the record says none
Because nobody asked. The form was completed by somebody assuming the supplier is local because the invoice is, and the question was never put to the supplier directly.