# Standards and Regulatory References

## Primary Legal Bases for Transfer Documentation

### GDPR Article 30 — Records of Processing Activities

- **Art. 30(1)(e)**: Controllers must document "transfers of personal data to a third country or an international organisation, including the identification of that third country or international organisation and, in the case of transfers referred to in the second subparagraph of Article 49(1), the documentation of suitable safeguards."
- **Art. 30(2)**: Processors must document "transfers of personal data to a third country or an international organisation, including the identification of that third country or international organisation."
- **Art. 30(3)**: Records must be maintained in writing (including electronic form).
- **Art. 30(4)**: Records must be made available to the supervisory authority on request.

### GDPR Article 5(2) — Accountability Principle

- The controller shall be responsible for, and be able to demonstrate compliance with, the GDPR principles.
- This requires maintaining documentation sufficient to demonstrate that cross-border transfers comply with Chapter V requirements.

### GDPR Article 24 — Responsibility of the Controller

- The controller must implement appropriate technical and organisational measures to ensure and demonstrate that processing is performed in accordance with the GDPR.
- These measures must be reviewed and updated where necessary.
- Documentation of transfer mechanisms constitutes part of these measures.

### GDPR Article 28(3)(a) — Processor Obligations

- The processor must not engage another processor without prior specific or general written authorisation of the controller.
- This requires maintaining sub-processor registers, including details of any onward transfers.

## Transfer Mechanism Documentation Requirements

### Standard Contractual Clauses (Art. 46(2)(c))

- **Commission Implementing Decision (EU) 2021/914** of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries.
- **Annex I**: Description of the transfer (parties, data, purposes, recipients, retention).
- **Annex II**: Technical and organisational measures including measures to ensure the security of data.
- **Annex III**: List of sub-processors (where applicable, for Modules 2 and 3).
- **Clause 14**: The data importer warrants it has no reason to believe that applicable laws prevent it from fulfilling its obligations — this assessment must be documented (TIA).

### Binding Corporate Rules (Art. 47)

- **Art. 47(2)(j)**: BCRs must contain "the mechanisms within the group of undertakings for ensuring the verification of compliance with the binding corporate rules" — requires documented audit and compliance records.
- **WP256 rev.01**: Working Document setting up a table with the elements and principles to be found in BCRs (controller).
- **WP257 rev.01**: Working Document setting up a table with the elements and principles to be found in BCRs (processor).

### Adequacy Decisions (Art. 45)

- **Art. 45(1)**: Transfer may take place where the EC has decided that the third country ensures an adequate level of protection.
- **Art. 45(3)**: The EC shall monitor developments in third countries that could affect the functioning of adequacy decisions.
- Organisations must document reliance on the adequacy decision and monitor for changes.

### Art. 49 Derogations

- **Art. 49(1)**: Derogations require specific conditions and documentation.
- **Art. 49(1)(2)**: For transfers based on compelling legitimate interests (Art. 49(1)(2)), the controller must "inform the supervisory authority of the transfer" and "in addition to providing the information referred to in Articles 13 and 14, inform the data subject of the transfer and on the compelling legitimate interests pursued."
- **Art. 49(6)**: "The controller or processor shall document the assessment as well as the suitable safeguards referred to in the second subparagraph of paragraph 1 of this Article in the records of processing activities referred to in Article 30."

## EDPB Guidance on Documentation

### EDPB Recommendations 01/2020 on Supplementary Measures (Version 2.0, June 2021)

- **Step 3**: "Assess if there is anything in the law or practice of the third country that may impinge on the effectiveness of the appropriate safeguards of the transfer tool you are relying on." — This assessment must be documented.
- **Step 4**: "Identify and adopt supplementary measures" — These must be documented with their effectiveness assessment.
- **Annex 2**: Provides examples of supplementary measures (technical, contractual, organisational) that should be recorded in the transfer register.

### EDPB Recommendations 02/2020 on European Essential Guarantees

- The assessment of whether the legal framework of the third country meets the European Essential Guarantees must be documented as part of the TIA.

### EDPB Guidelines on Records of Processing Activities (2023 Consultation)

- Clarifies that Art. 30 records should include sufficient detail about international transfers to demonstrate compliance.
- Recommends including the specific transfer mechanism, any safeguards, and review dates.

## National Supervisory Authority Guidance

### BfDI (Germany) — Guidance on International Data Transfers (2022)

- Organisations must maintain a comprehensive transfer register.
- The register must be updated without undue delay when transfers change.
- Evidence of TIAs and supplementary measures must be retained for inspection.

### CNIL (France) — Guide on Data Transfers Outside the EU (2023)

- Recommends maintaining a "transfer mapping" (cartographie des transferts) as part of the Art. 30 register.
- Emphasises documenting the assessment process, not just the outcome.

### ICO (UK) — International Transfer Documentation

- The ICO's Transfer Risk Assessment tool requires organisations to document the assessment of each transfer.
- Records must demonstrate that the organisation has taken a risk-based approach.
- The ICO expects records to be available within a reasonable period upon request.

### AEPD (Spain) — Guide on International Data Transfers (2022)

- The register must identify the specific legal basis for each transfer under Chapter V.
- Documentation of due diligence on importers is expected.

## Enforcement Precedents on Documentation

### CNIL — Amazon France Logistique (2024) — EUR 32 million

- Among the findings: inadequate documentation of video surveillance processing activities under Art. 30.
- Demonstrates that incomplete Art. 30 records attract significant fines.

### BfDI — Deutsche Wohnen SE (2019/2022) — EUR 14.5 million

- Fine for failure to implement sufficient technical and organisational measures for data retention and deletion.
- Highlights that record-keeping failures can compound with other violations.

### Danish DPA — Danske Bank (2022) — DKK 10 million recommendation

- Found that the bank could not account for the legal basis and retention period for a significant number of processing activities.
- Reinforces the obligation to maintain comprehensive, accurate processing records.

### Hamburg DPA — H&M (2020) — EUR 35.26 million

- While primarily a surveillance case, the DPA noted the lack of documentation and audit trails as aggravating factors.

## Retention Requirements for Transfer Records

| Document Type | Minimum Retention | Basis |
|--------------|-------------------|-------|
| Transfer register entries | Duration of transfer + 5 years | Art. 5(2) accountability; statute of limitations |
| Executed SCCs | Duration of transfer + 6 years | Contractual document; limitation period |
| TIA documentation | Duration of transfer + 5 years | EDPB Rec. 01/2020 |
| Audit trail logs | Duration of transfer + 5 years | Art. 5(2) accountability |
| SA correspondence | Duration of matter + 10 years | Regulatory record |
| BCR audit reports | Duration of BCR participation + 5 years | Art. 47(2)(j) |
| Derogation assessments | Duration of transfer + 5 years | Art. 49(6) |
| Sub-processor records | Duration of sub-processing + 5 years | Art. 28(3)(a) |