Transfer mechanism assessment: documents to prepare

A transfer mechanism assessment checks whether the chosen legal basis for moving personal data outside the exporter's jurisdiction still holds. The file needs a data flow map, the current transfer agreement, a list of sub-processors, and a record of any supplementary measures already in place. Missing any one of these delays the decision by weeks, not days.

What changes once the assessment starts

Once the review opens, the transfer cannot proceed on the old paperwork alone. Any renewal of the underlying contract, any new sub-processor, or any change of storage location resets the clock on the assessment. Treat the exercise as a gate, not a formality: a stalled review blocks the transfer, and a rushed one creates exposure that surfaces later, usually during a client audit or a vendor's own compliance sweep.

The point of no return sits earlier than most teams expect. Once the risk summary reaches the decision maker, withdrawing it and starting again costs more than finishing the review properly the first time. A file assembled in the wrong order — contract review before the data flow map, for instance — routinely comes back for rework.

Documents to prepare, in order

1. Collect the data flow map first. The vendor relationship owner sets out where the data originates, where it lands, and which entities touch it along the way.
2. Pull the current transfer agreement and any addenda. The contracts team confirms that the version on file is the one actually governing the transfer today.
3. List every sub-processor with a role in the chain. The data protection lead checks that list against the vendor's own sub-processor register.
4. Assemble the supplementary measures record. Whoever ran the last risk review supplies encryption, access-control, and audit logs already documented elsewhere.
5. Draft the risk summary for internal sign-off. The reviewer states the residual risk in one paragraph, not a slide deck.
6. Route the file to the decision maker named below, with a firm deadline attached.

Who decides, and how long it takes

The decision sits with whoever owns data protection risk inside the organisation — usually a data protection officer, or the person holding that mandate by delegation where no formal appointment exists. The table below sets out typical stages for a straightforward file.

End to end, a clean file usually closes in two to three weeks. A file that stalls at sub-processor mapping — because a vendor does not answer — routinely doubles that.

Common branches in the file

If the transfer also involves licensed software or a dataset under third-party licence, the file needs a parallel Due diligence on chain of title check before the transfer clauses are finalised. Licence gaps surface exactly the way a missing sub-processor entry does: late, and at the worst possible moment.

If the other side raises a damages claim before offering any indication of loss, treat that as a separate track entirely. The assessment file does not resolve a demand made When damages are demanded without evidence: when the other side moves first — that question belongs with the dispute team, not the assessment reviewer.

If the transfer sits inside a wider technology contract carrying an indemnity clause, the negotiation follows its own path; see How IP indemnity negotiation technology contract what the decision maker looks at for how that separate decision gets made.

If the underlying service also involves issuing a token or another digital asset with cross-border reach, a parallel Cross-border offer assessment: documents to prepare file runs alongside this one. The two files rarely close on the same day, and neither should be rushed to match the other's timeline.

What this page does not decide

This page describes the assessment file, not the legal test behind it. It does not decide whether a specific mechanism remains valid under current guidance, and it does not replace a case-by-case reading of the contract in front of you. Where the file reveals a genuine gap, that gap goes to a specialist review — it does not get closed by adding another checklist item here.

Related reading

A comparable file structure applies wherever a third party enters the data chain for a reason other than an existing transfer. See Vendor assessment procedure for the equivalent set of documents when the review concerns bringing on a new vendor rather than assessing a transfer already in place.

Where the file uncovers a gap that needs a decision beyond the checklist, route it through your usual internal contact rather than closing the assessment on an assumption.

Verified

This procedure draws on internal file templates and the current supervisory approach to international transfers, reviewed each time that guidance changes materially. No specific statutory reference is cited on this page, in line with how this procedure is documented across the site: where a point of law needs confirming for a particular file, that check happens inside the specialist review named above, not inside a general checklist.

FAQ

How long does transfer mechanism assessment take in practice?

A clean file typically closes in two to three weeks, stage by stage as set out in the table above. Files that stall at sub-processor mapping, because a vendor does not respond promptly, routinely take longer.

Which documents are needed to start?

Intake needs a data flow map and the current transfer agreement on file. Everything else — the sub-processor list, the supplementary measures record, and the risk summary — builds on those two documents, so starting without them causes rework later rather than saving time now.

What happens if the other side does not respond?

The file does not close on silence. If a sub-processor or counterparty does not answer within a reasonable window, the reviewer notes the gap in the risk summary and escalates to the decision maker rather than assuming the missing answer is favourable.

— Rasa Tumenaite, AURELIS