Listing of non-recurring data disclosures and contractual commitment to informing them to customers

Critical
High
Normal
Low

The organization must have clear procedures for situations where the organization is required by law to disclose personal information to the authorities. In addition, a list must be kept of these individual data disclosures.

The organization shall pay particular attention to the communication of these situations and the timing of the communication to interested customers, unless this is illegal due to, for example, an ongoing investigation or other legal matter.

These practices must be describeable to interested customers upon request. Procedures and reporting obligations must be described, e.g. contracts for offered digital services.

Connected other frameworks and requirements:
A.6.1: PII disclosure notification
ISO 27018
A.6.2: Recording of PII disclosures
ISO 27018
A.6: Use, retention and disclosure limitation
ISO 27018
A.8.5.1: Basis for PII transfer between jurisdictions
ISO 27701
A.8.5.4: Notification of PII disclosure requests
ISO 27701

Documentation of bases for personal data transfer for relevant partners

Critical
High
Normal
Low

GDPR defines the conditions for the lawful transfer of personal data outside the EU or the EEA.

The organization shall document all data transfers and the applicable transfer criteria. Data transfers can occur, for example, based on the location of the data system, the data processing partner or the recipient of the data disclosure.

Connected other frameworks and requirements:
44. General principle for transfers
GDPR
45. Transfers on the basis of an adequacy decision
GDPR
46. Transfers subject to appropriate safeguards
GDPR
47. Binding corporate rules
GDPR
48. Transfers or disclosures not authorised by Union law
GDPR
No items found.