Learn more about the connected frameworks

A.8.5.5
ISO 27701

Legally binding PII disclosures

Other tasks from the same security theme

Readiness to provide a list of data transfers to the data subject

Critical
High
Normal
Low

Upon request, the organization offers the registered person a clear list of the transfers of his personal data to third parties. 

The list shows in particular which personal data has been transferred, to which organization, on what basis and when.

No items found.

Rejecting any non-legally binding requests for personal data disclosure

Critical
High
Normal
Low

The organization should reject all non-legally binding personal data disclosure requests, but accept all contractually defined personal data disclosures that the customer has accepted. The relevant customer must be asked before handing over personal data.

A.8.5.5: Legally binding PII disclosures
ISO 27701

Records of personal data disclosures to third parties

Critical
High
Normal
Low

The organization should save information concerning personal data disclosures to third parties. The information should include what personal data has been disclosed, to whom and when.

A.7.5.4: Records of PII disclosure to third parties
ISO 27701

Records of personal data transfers to third parties

Critical
High
Normal
Low

The organization should record transfers of personal data to and from third parties. The organization should also ensure the cooperation of the relevant parties in order to enable the implementation of requests regarding obligations related to data subjects in the future as well.

The principle of data minimization must be taken into account in recordings concerning transfers and only the information that is actually needed must be kept.

A.7.5.3: Records of transfer of PII
ISO 27701
A.8.5.3: Records of PII disclosure to third parties
ISO 27701

Documenting states and international organizations receiving personal data

Critical
High
Normal
Low

The organization should determine and document the countries and international organizations to which personal data may be transferred.

States and international organizations to which personal data can be transferred under normal circumstances must be communicated to the data subjects.

A.7.5.2: Countries and international organizations to which PII can be transferred
ISO 27701
A.8.5.2: Countries and international organizations to which PII can be transferred
ISO 27701

Legal bases for personal data transfers between different legal zones

Critical
High
Normal
Low

The organization has identified possible transfers of personal data between jurisdictions.

There are identified and documented legal bases for transfers of personal data between jurisdictions.

A.7.5.1: Identity basis for PII transfer between jursdictions
ISO 27701

Documentation of data disclosures for data stores

Critical
High
Normal
Low

The data in a data store are, in principle, only available to that controller and under the same responsibility. If you pass data on to another organization for other use, you must clearly inform about it and state e.g. the recipient of the transfer and the legal basis.

12. Transparent information, communication and modalities for the exercise of the rights of the data subject
GDPR
28. Processor
GDPR
30. Records of processing activities
GDPR
A.6.2: Recording of PII disclosures
ISO 27018
A.7.3.7: PII controllers' obligations to inform third parties
ISO 27701

Documentation of bases for personal data transfer for relevant partners

Critical
High
Normal
Low

GDPR defines the conditions for the lawful transfer of personal data outside the EU or the EEA.

The organization shall document all data transfers and the applicable transfer criteria. Data transfers can occur, for example, based on the location of the data system, the data processing partner or the recipient of the data disclosure.

44. General principle for transfers
GDPR
45. Transfers on the basis of an adequacy decision
GDPR
46. Transfers subject to appropriate safeguards
GDPR
47. Binding corporate rules
GDPR
48. Transfers or disclosures not authorised by Union law
GDPR

Inventory and documentation of data processing agreements

Critical
High
Normal
Low

The processors of personal data (e.g. providers of data systems, other partners using our employee or customer data) and the agreements related to the processing of personal data have been documented. The documentation includes e.g.:

  • Processor name and location
  • Purpose of processing data
  • Status of agreement
28. Processor
GDPR
13.2.2: Agreements on information transfer
ISO 27001
15.1.2: Addressing security within supplier agreements
ISO 27001
A.8.2.4: Infringing instruction
ISO 27701
5.14: Information transfer
ISO 27001